program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x8052, &(0x7f00000000c0), 0x1, 0x4de, &(0x7f0000000c40)="$eJzs3E1oXNUeAPD/nUma9Ot1Xl9f32utmlrFYDFp02q7EKSi4EJBrKAuQ5KW2rSRJgVbqkxB6lIK7sWlWxdu1U0RV4LbuhSkUKSbtoI4cmfunZlMZ5ImmWSM+f1gMufcr3POPffcOfeczASwYQ2lf5Ja+GZE7IiIQusGQ7W3e3euTNy/c2UiypXKyd+S6m5303gmO0xszSLDhYjCx0ljRZPZS5fPjk9PT13I4qNz594fnb10+dkzg9mS48ePHjl87Pmx55ZeqDbppeW6u/ejmX17Xn33+usTffnyPLXmcnTLUAy1y0rVU91OrMe2N4WTvh5mhCVJr/+0uvqr7X9HFGOhyiuvYc6A1VapVCoDnVeXK62uPrAEWLeS6HUOgN7IP+jT59/81a4jsGl1uh89d/tE7QEoLfe97BXxeHVhPg7S3/J8201DEfFO+ffP01es0jgEAECzb0/kPcGW/l+pNjPyx8UbL6bv/8rmUEoR8e+I2BkR/4mIXRHx34jYHRH/i4j/txy/GBGVBdIfaonX069PQhVudamobaX9vxeyua1G/29eBkrFLLY9Iu8wTx3Kzslw9A+cOjM9dXiBNL57+adPO61r7v+lrzT9vC+Y5eNWX8sA3eT43PiyC9zi9tWIvX2t5U/6IpL6TEASEXsiYu8SjltqCp955st99Uj//O0WL39Vpe08WhfmmSpfRDxdq/9yzKv/RorJvPnJc+Onp05PnR+rz0+ODsb01KHR9Co41DaNH3689kan9Bct/9e/tO7yyrFvTmYta+XS+t/SdP1HPn/bKH8piUjq87WzS0/j2s+fdHymWe71vyl5qxrOn0s/GJ+bu3A4YlPy2oPLxxr75vH0Pcq18g8faN/+d2b7pGfikYhIL+JHI+KxqD0hpnnfHxFPRMSBBcr//UtPvrf88q+utPyTLfe/Ws3Pq//GfH2nQJLNDbZZVTy7/+b9DjePh6v/o9XQcLak/f0vmXeL6JTT/NMuXfLnis8eAAAArA+FiNjWNJa0LQqFkZHaGNCu2FKYnpmdO3hq5uL5yXRdRCn6C/lIV208uD/Jxz9LTfGxlviRbNz4s+LmanxkYmZ6sqclB7ZW23xSGIl4u9jU/lO/dmeIGfg7830t2LgWav9pJ3739TXMDLCmHv7z/8aHq5oRYM01tf9O3/AvL+P/voB1wPM/0LD4D/24Z8D6V9GWYUNbUvs/6EcA4Z+kL96shws9zQmw1vT/YUNa9Hv9KwpUBtqvGowHN47BhQ9YjOVlY3ObtHoSSHtWPUl983L2yn9NoeM2UVjaAQeiO3V6aoVno3xh9vTurl/8lex/5btdg1+tSTttF+jJ7QgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDr/goAAP//aUHglQ==") open(&(0x7f00000000c0)='./file1\x00', 0x14927e, 0x6) r2 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2ac00) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x800000c, 0x12, 0x1b, 0x0, "9e959f16deab7b08aa26e66c4056a516950600000000000000eef4fb0efcc1d8a6078ed9d5f8643902dd8f6fac274de9d940ffa5e592bbd48685450d00002000", "f625c10e6e0080ffffffffffffffff7e904dc8df6aa3a893ec00347f41be6908", [0xa, 0x80000476]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x183341, 0x0) [ 94.053649][ T5283] Bluetooth: hci0: command tx timeout [ 94.095691][ T5320] loop0: detected capacity change from 0 to 1024 [ 94.302551][ T5321] syz.0.0: attempt to access beyond end of device [ 94.302551][ T5321] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 94.311369][ T5321] Buffer I/O error on dev loop0, logical block 2889, async page read [ 94.311455][ T5321] syz.0.0: attempt to access beyond end of device [ 94.311455][ T5321] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 94.311491][ T5321] Buffer I/O error on dev loop0, logical block 2889, async page read [ 94.322926][ T5321] [ 94.336847][ T5321] ====================================================== [ 94.339442][ T5321] WARNING: possible circular locking dependency detected [ 94.342110][ T5321] syzkaller #0 Not tainted [ 94.343867][ T5321] ------------------------------------------------------ [ 94.346644][ T5321] syz.0.0/5321 is trying to acquire lock: [ 94.349024][ T5321] ffff88801d2ac0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.353166][ T5321] [ 94.353166][ T5321] but task is already holding lock: [ 94.356198][ T5321] ffff8880529b5a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 94.360901][ T5321] [ 94.360901][ T5321] which lock already depends on the new lock. [ 94.360901][ T5321] [ 94.364973][ T5321] [ 94.364973][ T5321] the existing dependency chain (in reverse order) is: [ 94.368352][ T5321] [ 94.368352][ T5321] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 94.372052][ T5321] __mutex_lock+0x19d/0x1550 [ 94.373985][ T5321] hfsplus_file_extend+0x21c/0x1df0 [ 94.376255][ T5321] hfsplus_bmap_reserve+0x170/0x590 [ 94.378583][ T5321] __hfsplus_ext_write_extent+0x295/0x690 [ 94.381130][ T5321] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.383915][ T5321] hfsplus_file_extend+0x502/0x1df0 [ 94.386242][ T5321] hfsplus_get_block+0x41f/0x1610 [ 94.388548][ T5321] __block_write_begin_int+0x6c2/0x1900 [ 94.390981][ T5321] cont_write_begin+0x71b/0xac0 [ 94.393226][ T5321] hfsplus_write_begin+0x126/0x1e0 [ 94.395578][ T5321] generic_perform_write+0x2d5/0x8f0 [ 94.397933][ T5321] generic_file_write_iter+0xae/0x330 [ 94.400390][ T5321] aio_write+0x5d0/0x870 [ 94.402486][ T5321] io_submit_one+0x798/0x13d0 [ 94.404713][ T5321] __se_sys_io_submit+0x195/0x340 [ 94.407346][ T5321] do_syscall_64+0x166/0x520 [ 94.409584][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.412268][ T5321] [ 94.412268][ T5321] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 94.415700][ T5321] __lock_acquire+0x15ff/0x2e50 [ 94.417935][ T5321] lock_acquire+0x115/0x350 [ 94.420069][ T5321] __mutex_lock+0x19d/0x1550 [ 94.422362][ T5321] hfsplus_find_init+0x179/0x2e0 [ 94.424654][ T5321] hfsplus_file_truncate+0x3e0/0xd20 [ 94.427014][ T5321] hfsplus_setattr+0x1b5/0x260 [ 94.429190][ T5321] notify_change+0xbba/0xea0 [ 94.431286][ T5321] do_truncate+0x1c2/0x250 [ 94.433463][ T5321] path_openat+0x15b5/0x1d60 [ 94.435658][ T5321] do_file_open+0x23e/0x4a0 [ 94.437788][ T5321] do_sys_openat2+0x115/0x200 [ 94.440029][ T5321] __x64_sys_open+0x11e/0x150 [ 94.442398][ T5321] do_syscall_64+0x166/0x520 [ 94.444805][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.447834][ T5321] [ 94.447834][ T5321] other info that might help us debug this: [ 94.447834][ T5321] [ 94.452375][ T5321] Possible unsafe locking scenario: [ 94.452375][ T5321] [ 94.455371][ T5321] CPU0 CPU1 [ 94.457681][ T5321] ---- ---- [ 94.459730][ T5321] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.461957][ T5321] lock(&tree->tree_lock/1); [ 94.464570][ T5321] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.467637][ T5321] lock(&tree->tree_lock/1); [ 94.469429][ T5321] [ 94.469429][ T5321] *** DEADLOCK *** [ 94.469429][ T5321] [ 94.472488][ T5321] locks held by syz.0.0/5321: 3, last CPU#0: [ 94.474810][ T5321] #0: ffff88801d13e460 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 94.478632][ T5321] #1: ffff8880529b5b98 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: do_truncate+0x18f/0x250 [ 94.482542][ T5321] #2: ffff8880529b5a00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 94.487357][ T5321] [ 94.487357][ T5321] stack backtrace: [ 94.489814][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.493683][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.497761][ T5321] Call Trace: [ 94.499155][ T5321] [ 94.500422][ T5321] dump_stack_lvl+0xe8/0x150 [ 94.502284][ T5321] print_circular_bug+0x2e2/0x300 [ 94.504487][ T5321] check_noncircular+0x12f/0x150 [ 94.506619][ T5321] __lock_acquire+0x15ff/0x2e50 [ 94.508664][ T5321] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.511189][ T5321] ? kasan_save_track+0x4f/0x80 [ 94.513273][ T5321] ? kasan_save_track+0x3e/0x80 [ 94.515378][ T5321] ? __kasan_kmalloc+0x93/0xb0 [ 94.517450][ T5321] ? __kmalloc_noprof+0x36b/0x720 [ 94.519553][ T5321] ? hfsplus_find_init+0x9d/0x2e0 [ 94.521541][ T5321] ? hfsplus_file_truncate+0x3e0/0xd20 [ 94.523440][ T5321] ? hfsplus_setattr+0x1b5/0x260 [ 94.525264][ T5321] ? notify_change+0xbba/0xea0 [ 94.527210][ T5321] lock_acquire+0x115/0x350 [ 94.529088][ T5321] ? hfsplus_find_init+0x179/0x2e0 [ 94.531210][ T5321] __mutex_lock+0x19d/0x1550 [ 94.533193][ T5321] ? hfsplus_find_init+0x179/0x2e0 [ 94.535361][ T5321] ? hfsplus_find_init+0x179/0x2e0 [ 94.537516][ T5321] ? __pfx___mutex_lock+0x10/0x10 [ 94.539494][ T5321] ? rcu_is_watching+0x16/0xb0 [ 94.541516][ T5321] ? trace_kmalloc+0x2a/0xf0 [ 94.543390][ T5321] ? __kmalloc_noprof+0x38c/0x720 [ 94.545275][ T5321] ? __kmalloc_noprof+0x1ab/0x720 [ 94.547348][ T5321] ? hfsplus_find_init+0x9d/0x2e0 [ 94.549277][ T5321] hfsplus_find_init+0x179/0x2e0 [ 94.551293][ T5321] hfsplus_file_truncate+0x3e0/0xd20 [ 94.553467][ T5321] ? __up_read+0x29c/0x930 [ 94.555302][ T5321] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 94.557576][ T5321] ? unmap_mapping_range+0xe7/0x190 [ 94.559649][ T5321] ? __pfx_unmap_mapping_range+0x10/0x10 [ 94.561801][ T5321] ? current_time+0x25a/0x380 [ 94.563666][ T5321] ? truncate_setsize+0xcf/0xf0 [ 94.565634][ T5321] hfsplus_setattr+0x1b5/0x260 [ 94.567575][ T5321] ? __pfx_hfsplus_setattr+0x10/0x10 [ 94.569927][ T5321] notify_change+0xbba/0xea0 [ 94.572064][ T5321] do_truncate+0x1c2/0x250 [ 94.574111][ T5321] ? __pfx_do_truncate+0x10/0x10 [ 94.576271][ T5321] ? apparmor_file_truncate+0x39f/0x470 [ 94.578587][ T5321] ? ima_file_truncate+0x10a/0x170 [ 94.580609][ T5321] path_openat+0x15b5/0x1d60 [ 94.582373][ T5321] do_file_open+0x23e/0x4a0 [ 94.584131][ T5321] ? __pfx_do_file_open+0x10/0x10 [ 94.586301][ T5321] ? _raw_spin_unlock+0x28/0x50 [ 94.588188][ T5321] ? alloc_fd+0x651/0x6c0 [ 94.590100][ T5321] do_sys_openat2+0x115/0x200 [ 94.592129][ T5321] ? __se_sys_futex+0x3a8/0x450 [ 94.594253][ T5321] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.596457][ T5321] ? rcu_is_watching+0x16/0xb0 [ 94.598427][ T5321] __x64_sys_open+0x11e/0x150 [ 94.600413][ T5321] do_syscall_64+0x166/0x520 [ 94.602408][ T5321] ? trace_irq_disable+0x3b/0x140 [ 94.604514][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.607093][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 94.609105][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.611611][ T5321] RIP: 0033:0x7f78c8b9e159 [ 94.613606][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.621754][ T5321] RSP: 002b:00007f78c4ff4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 94.625269][ T5321] RAX: ffffffffffffffda RBX: 00007f78c8e26090 RCX: 00007f78c8b9e159 [ 94.628508][ T5321] RDX: 0000000000000006 RSI: 000000000014927e RDI: 00002000000000c0 [ 94.631745][ T5321] RBP: 00007f78c8c35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.635220][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.638597][ T5321] R13: 00007f78c8e26128 R14: 00007f78c8e26090 R15: 00007ffe5f75e448 [ 94.641998][ T5321] [ 94.692526][ T26] audit: type=1800 audit(1788578756.076:2): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 94.744603][ T5321] hfsplus: can't free extent: start 2889, count 1