program: syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f00000000c0)=ANY=[], 0x1, 0x5f9, &(0x7f0000000c80)="$eJzs3U9sHFcdB/DvbDaON0ip2yZtQJWwGqkgLCV2Vi6YCwEh5EOFqnLgbCWbxsrGrewtMhwg/L9y6IFjOfjGCYl7pHKGW2/Ix0pIXHryLWhmZ+2NvXXt1PGuyecTvX3vzdt5781vdv7sWtEEeG4tz6X5KEWW597aLOvbW+3u9lb7waCc5EKSRtLsZynWkuLj5Fb6KV8tF9bdFZ83zoerS+988tn2p/1as04p0jqJrXhYp8wmOVfnJ9Xf7S/dX1Gl6bp2bRA4GLfHBzw8zuqfe7wDZ0fRv24eMJNcTKprV3kfkPrs0Djd2Z28Y53lAAAAYHL9+8+HNL6wk51s5tIpzgcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADOrHb91P/6+f9FnRqD8myKwfP/p+plqctn2qNxTwAAAAAAAAAATsDXd7KTzVwa1B8X1d/8X68ql6vXr+SDbKST9VzPZlbSSy/rWUgyM9TR1OZKr7e+cIQ1b45c8+bpbC8AAAAAAAAA/J/6TZb3/v4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACToEjO9bMqPRyUZ9JoJplOMpV+w78G5bPs0bgnAAAAAE9v5uCiCyPf+MJOdrKZS4P64yKXk7xSfe+fzgdZSy+r6aWbTu5UvwX0v/U3trfa3e2t9oMyHez3+/891nyrHtP/7WH0yFerd7RyN6vVkuu5nffSzZ00qjVLVwfzGT2vX5dzKr5XO+LM7tR5ueV/qvNTM3qf1WaqiJzfjch8PbcyGi8eHolj7p39Iy2ksfvLz+VnEPOLdV5uzx9OO+aH2h+Jm0OfvlcOj0Tyjb//9af3umv3793dmJucTXpK+yPRHorEq89VJOarSFzZrS/nR/lJ5jKbt7Oe1fwsK+mlk9n8sCqt1J/n8nXm8EjdeqL29hfNZKreL/2z6PHm9Hq17qWs5sd5L3fSyZvVv5tZyLezmMUsDe3hK0c46hvHO+qvfbMutJL8sc4nQxnXF4fiOnzOnanahpfsRemlkz83Nr9WF8oxflvnk2F/JBaGIvHy4ZH4y+PydaO7dn/93sr7RxzvjTovj6PfT9RVovy8vFTurKr25KejbHt5ZNtC1XZ5t61xoO3KbtsXHalT9T3cgZ6m+7N7deQo7art6lDbE/dbRf9+C4CJd/FbF6da/2n9s/VR63ete623pn9w4TsXXpvK+X+c/25z/twbjdeKv+Wj/HLv+z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPD0Nn7+i/sr3W5nXeG5LGzWz9wbx+jnk0xEEM5A4Vc57UHHfWYCnrUbvQfv39hoJXmw8m7n3c7a0uLi0vzS4pvtG3dXu535/uu4Zwk8C3sX/XHPBAAAAAAAAAAAADiq0/jvBOPeRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBsW55L81GKLMxfny/r21vtbpkG5b13NpMUdbn4OLmVfsrMUHfFvu7PDQofri6988ln25/u9dUcvL8xYr1jelinzNZjzp5gf7e/dH/F7haWAbs2CByM2/8CAAD//9GICnM=") unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x7, 0x73, 0x9, 0x2}, {0xc, 0x7f, 0x6}, {0x81, 0x2, 0x5, 0x3}, {0x6, 0xff, 0x10, 0x3}]}) [ 84.846796][ T4664] Bluetooth: hci0: command tx timeout [ 84.954767][ T5318] loop0: detected capacity change from 0 to 1024 [ 85.070848][ T5318] [ 85.071907][ T5318] ============================================ [ 85.074431][ T5318] WARNING: possible recursive locking detected [ 85.076984][ T5318] syzkaller #0 Not tainted [ 85.078880][ T5318] -------------------------------------------- [ 85.081338][ T5318] syz.0.0/5318 is trying to acquire lock: [ 85.083697][ T5318] ffff888042328e88 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_get_block+0x39e/0x1670 [ 85.088332][ T5318] [ 85.088332][ T5318] but task is already holding lock: [ 85.091336][ T5318] ffff88804232a2c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2b3/0xc30 [ 85.096024][ T5318] [ 85.096024][ T5318] other info that might help us debug this: [ 85.099620][ T5318] Possible unsafe locking scenario: [ 85.099620][ T5318] [ 85.102713][ T5318] CPU0 [ 85.104178][ T5318] ---- [ 85.105627][ T5318] lock(&HFSPLUS_I(inode)->extents_lock); [ 85.108215][ T5318] lock(&HFSPLUS_I(inode)->extents_lock); [ 85.110971][ T5318] [ 85.110971][ T5318] *** DEADLOCK *** [ 85.110971][ T5318] [ 85.114519][ T5318] May be due to missing lock nesting notation [ 85.114519][ T5318] [ 85.118104][ T5318] 6 locks held by syz.0.0/5318: [ 85.120177][ T5318] #0: ffff888041b7a420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 85.124104][ T5318] #1: ffff888042329738 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 [ 85.128788][ T5318] #2: ffff88804232a4b8 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: vfs_unlink+0xed/0x6c0 [ 85.133078][ T5318] #3: ffff888011b8e198 (&sbi->vh_mutex){+.+.}-{4:4}, at: hfsplus_unlink+0x182/0x930 [ 85.137216][ T5318] #4: ffff88804232a2c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2b3/0xc30 [ 85.142088][ T5318] #5: ffff888011b8e0f8 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_block_free+0xc7/0x630 [ 85.146351][ T5318] [ 85.146351][ T5318] stack backtrace: [ 85.149011][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.149025][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.149032][ T5318] Call Trace: [ 85.149039][ T5318] [ 85.149044][ T5318] dump_stack_lvl+0xe8/0x150 [ 85.149066][ T5318] print_deadlock_bug+0x279/0x290 [ 85.149086][ T5318] __lock_acquire+0x253f/0x2cf0 [ 85.149102][ T5318] ? lock_release+0x4b/0x3a0 [ 85.149115][ T5318] ? is_bpf_text_address+0x292/0x2b0 [ 85.149131][ T5318] ? is_bpf_text_address+0x26/0x2b0 [ 85.149147][ T5318] ? kernel_text_address+0xa5/0xe0 [ 85.149166][ T5318] ? hfsplus_get_block+0x39e/0x1670 [ 85.149183][ T5318] lock_acquire+0x106/0x330 [ 85.149195][ T5318] ? hfsplus_get_block+0x39e/0x1670 [ 85.149213][ T5318] __mutex_lock+0x19f/0x1300 [ 85.149347][ T5318] ? hfsplus_get_block+0x39e/0x1670 [ 85.149362][ T5318] ? check_path+0x21/0x40 [ 85.149375][ T5318] ? hfsplus_get_block+0x39e/0x1670 [ 85.149389][ T5318] ? add_lock_to_list+0xc7/0x100 [ 85.149400][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 85.149420][ T5318] hfsplus_get_block+0x39e/0x1670 [ 85.149436][ T5318] ? __pfx_hfsplus_get_block+0x10/0x10 [ 85.149449][ T5318] ? do_raw_spin_unlock+0x4d/0x210 [ 85.149464][ T5318] ? _raw_spin_unlock+0x28/0x50 [ 85.149476][ T5318] block_read_full_folio+0x29f/0x830 [ 85.149489][ T5318] ? __pfx_hfsplus_get_block+0x10/0x10 [ 85.149503][ T5318] filemap_read_folio+0x137/0x3b0 [ 85.149516][ T5318] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 85.149529][ T5318] ? __pfx_filemap_read_folio+0x10/0x10 [ 85.149540][ T5318] ? filemap_add_folio+0x356/0x530 [ 85.149551][ T5318] do_read_cache_folio+0x358/0x590 [ 85.149564][ T5318] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 85.149577][ T5318] read_cache_page+0x5d/0x170 [ 85.149613][ T5318] hfsplus_block_free+0x134/0x630 [ 85.149626][ T5318] ? trace_kmalloc+0x1f/0xb0 [ 85.149639][ T5318] hfsplus_free_extents+0x121/0xa50 [ 85.149655][ T5318] hfsplus_file_truncate+0x762/0xc30 [ 85.149671][ T5318] ? hfsplus_delete_cat+0x860/0xe80 [ 85.149684][ T5318] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 85.149695][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 85.149711][ T5318] hfsplus_delete_inode+0x180/0x230 [ 85.149724][ T5318] hfsplus_unlink+0x4ee/0x930 [ 85.149738][ T5318] ? __pfx_hfsplus_unlink+0x10/0x10 [ 85.149754][ T5318] ? __pfx_down_write+0x10/0x10 [ 85.149770][ T5318] ? try_break_deleg+0x5b/0x180 [ 85.149780][ T5318] vfs_unlink+0x272/0x6c0 [ 85.149794][ T5318] filename_unlinkat+0x3cd/0x610 [ 85.149806][ T5318] ? __pfx_filename_unlinkat+0x10/0x10 [ 85.149820][ T5318] ? do_getname+0x151/0x250 [ 85.149832][ T5318] __se_sys_unlinkat+0x83/0x1a0 [ 85.149845][ T5318] do_syscall_64+0x14d/0xf80 [ 85.149857][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.149867][ T5318] ? trace_irq_disable+0x37/0x100 [ 85.149877][ T5318] ? clear_bhb_loop+0x40/0x90 [ 85.149889][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.149901][ T5318] RIP: 0033:0x7f709339bf79 [ 85.149913][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.149923][ T5318] RSP: 002b:00007f708f7f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 85.149954][ T5318] RAX: ffffffffffffffda RBX: 00007f7093615fa0 RCX: 00007f709339bf79 [ 85.149962][ T5318] RDX: 0000000000000000 RSI: 0000200000000c40 RDI: ffffffffffffff9c [ 85.149969][ T5318] RBP: 00007f70934327e0 R08: 0000000000000000 R09: 0000000000000000 [ 85.149975][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.149982][ T5318] R13: 00007f7093616038 R14: 00007f7093615fa0 R15: 00007ffd22112f58 [ 85.149995][ T5318] [ 85.405120][ T24] audit: type=1326 audit(1770763150.389:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5317 comm="syz.0.0" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f709339bf79 code=0x0 [ 85.413840][ T5318] hfsplus: unable to mark blocks free: error -5 [ 85.416588][ T5318] hfsplus: can't free extent: start 134, count 1