program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000140)='./file1\x00', 0x1018400, &(0x7f0000000080)=ANY=[], 0x85, 0x675, &(0x7f0000000800)="$eJzs3c1vHGcdB/DvrNd2NlSpmyZtiiolaiRARCR2rBTMpQEhlEOFqnLgbCVOYmWTFsdFboVIeL/2kD+gHHLjgJC4R5QLF7j16mMlBJdeMKdFMzu73vh13SZeO/18qsfPM/PM8/bbmZ19abQBvrSunEvzUYpcOffmSrm9+nC2vfpw9navnGQySSNpdrMU/+10Oh8nl9NNeaXcWXdXbDfOg8W5tz/5bPXT7lazTtXxjZ3aDed+nXImyVidP6n+ru7W35Hduiv6KywDdrYXOBi18SSdyr8fdPf89O/P9WsGtLZqveuZDxwCRfe+uclUcrS+0MvXAd274r3qnn2o3R/1BAAAAGAfPL+Wtazk2KjnAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIdJ/fv/RZ0avfKZFL3f/5+o96UuHyyn93b4o6c1DwAAAAAAAADYR6fXspaVHOttd4rqO//Xqo0T1d+v5L3czUKWcj4rmc9ylrOUmSRTAx1NrMwvLy/N9Fv2/s+AzS0vbtny4i4Tnazz1pNYNQAAAAAAAAA8c36VK+vf/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEFQJGPdrEqNXnkqjWaSI0kmyuPuJ//slQ+zR6OeAAAAAHwBnSGPe34ta1nJsX67IieSvFS97z+S93Iny1nMctpZyLXqs4Duu/7G6sPZ9urD2dtl2tzv9/6zp+lO1J81jFVbW418qjqiletZrPacz9W8k6K4lkbVsnSqN5+t5/XLck7FG13jQ87sWp2XK/+wzje5t6fFbmePH6ZMVREZ70dkup5bGY0Xdo7EHh+djSPNpNGf7IkNI21YxGMxf2PI8Y7Webme320X85HYGImLA2ffSzvHPPn6X/74k5vtO7duXr977uAsaThjdd59XmltjsTsQCRefpYjscl0FYmT/e0r+WF+nHM5k7eylMX8LPNZzkLO5AdVab4+n4uBS36bSF1+bOut3WYyUZ+h3Qfr8Tlllzm9VrU9lsX8KO/kWhbyevXfxczk27mUS5kbeIRPDvFM29j6qp/cZvJnv1EXWkl+X+eVG83dFv6UlXF9YSCug8+5U1Xd4J71KB3fw/2oF6U/7TyV5lfrQjnGr+v8YNgYiZmBSLy4cyT+UD2t3G3fubV0c/7d4YY7/mFdKK+j3w51l9iv86g8X473x3v87CjrXqzrxqu0Hq+y7kS/XWNT3cl+XfdKvb/tlTpRv4bb3NPFqu7lLetmq7pTA3UbX2+1+6+HnoUvfwCeWUe/eXSi9a/WP1oftX7Tutl688j3J78z+epExv82/t3m9NjXGq8Wf85H+cX6+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODzu/v+B7fm2+2FpQ2FTqdzb5uqw1zo/ZzZPg76ynPJqJY8keRgRP5/nU6n3lMchPnsXOiUJtP5nM3/mmS4g5tJtqo6PfogjPiJCXjqLizffvfC3fc/+Nbi7fkbCzcW7sxdujQ3PXfp9dkL1xfbC9Pdv6OeJfA0rN/0Rz0TAAAAAAAAAAAAYFj78c8Jth/9yH4uFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADikrpxL81GKzEyfny63Vx/OtsvUK68f2UzSSFL8PCk+Ti6nmzI10F2x3TgPFufe/uSz1U/rvjr31o9v7NRuOPfrlDNJxur8SfV39Qv3V/RXWAbsbC9wMGr/DwAA///oFAcF") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xc6081, 0x19f) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x82200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe89) open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) r2 = creat(&(0x7f0000000380)='./bus\x00', 0x0) r3 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$BLKROSET(r3, 0x125d, &(0x7f00000001c0)=0x4) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r2, &(0x7f0000000000), 0xfffffffe, 0x16}]) [ 132.693194][ T5285] Bluetooth: hci0: command tx timeout [ 132.793075][ T5324] loop0: detected capacity change from 0 to 1024 [ 132.924715][ T5324] syz.0.0: attempt to access beyond end of device [ 132.924715][ T5324] loop0: rw=34817, sector=5778, nr_sectors = 2 limit=1024 [ 132.925851][ T5324] [ 132.932416][ T5324] ============================================ [ 132.934909][ T5324] WARNING: possible recursive locking detected [ 132.937545][ T5324] syzkaller #0 Not tainted [ 132.939423][ T5324] -------------------------------------------- [ 132.941886][ T5324] syz.0.0/5324 is trying to acquire lock: [ 132.944185][ T5324] ffff88805280c740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 132.948723][ T5324] [ 132.948723][ T5324] but task is already holding lock: [ 132.951769][ T5324] ffff88805280a040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 132.956235][ T5324] [ 132.956235][ T5324] other info that might help us debug this: [ 132.959504][ T5324] Possible unsafe locking scenario: [ 132.959504][ T5324] [ 132.964480][ T5324] CPU0 [ 132.965914][ T5324] ---- [ 132.967381][ T5324] lock(&HFSPLUS_I(inode)->extents_lock); [ 132.969821][ T5324] lock(&HFSPLUS_I(inode)->extents_lock); [ 132.972329][ T5324] [ 132.972329][ T5324] *** DEADLOCK *** [ 132.972329][ T5324] [ 132.975734][ T5324] May be due to missing lock nesting notation [ 132.975734][ T5324] [ 132.979175][ T5324] locks held by syz.0.0/5324: 4, last CPU#0: [ 132.981566][ T5324] #0: ffff88801d0ce460 (sb_writers#11){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 [ 132.985615][ T5324] #1: ffff88805280a1d8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 132.990201][ T5324] #2: ffff88805280a040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 132.994942][ T5324] #3: ffff888012de80a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 132.998943][ T5324] [ 132.998943][ T5324] stack backtrace: [ 133.001420][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 133.005017][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 133.009388][ T5324] Call Trace: [ 133.010809][ T5324] [ 133.012079][ T5324] dump_stack_lvl+0xe8/0x150 [ 133.014116][ T5324] print_deadlock_bug+0x27a/0x290 [ 133.016094][ T5324] __lock_acquire+0x25db/0x2de0 [ 133.018125][ T5324] ? rcu_is_watching+0x16/0xb0 [ 133.020205][ T5324] ? lock_release+0x4b/0x3c0 [ 133.022226][ T5324] ? lock_release+0x4b/0x3c0 [ 133.024142][ T5324] ? is_bpf_text_address+0x292/0x2b0 [ 133.026476][ T5324] lock_acquire+0x115/0x350 [ 133.028421][ T5324] ? hfsplus_file_extend+0x21c/0x1df0 [ 133.030762][ T5324] __mutex_lock+0x19d/0x1550 [ 133.032781][ T5324] ? hfsplus_file_extend+0x21c/0x1df0 [ 133.035343][ T5324] ? stack_trace_save+0xa9/0x100 [ 133.037458][ T5324] ? __pfx_stack_trace_save+0x10/0x10 [ 133.039683][ T5324] ? check_path+0x21/0x40 [ 133.041496][ T5324] ? hfsplus_file_extend+0x21c/0x1df0 [ 133.043785][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 133.045922][ T5324] ? add_lock_to_list+0xc7/0x100 [ 133.048012][ T5324] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 133.050439][ T5324] hfsplus_file_extend+0x21c/0x1df0 [ 133.052619][ T5324] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 133.054945][ T5324] ? __pfx___mutex_trylock_common+0x10/0x10 [ 133.057309][ T5324] ? rcu_is_watching+0x16/0xb0 [ 133.059188][ T5324] ? trace_contention_end+0x3d/0x140 [ 133.061185][ T5324] ? __asan_memset+0x22/0x50 [ 133.063377][ T5324] ? hfsplus_brec_find+0x19a/0x510 [ 133.065469][ T5324] hfsplus_bmap_reserve+0x170/0x590 [ 133.067619][ T5324] __hfsplus_ext_write_extent+0x295/0x690 [ 133.069872][ T5324] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 133.072211][ T5324] ? hfsplus_find_init+0x179/0x2e0 [ 133.074290][ T5324] hfsplus_file_extend+0x502/0x1df0 [ 133.076375][ T5324] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 133.078698][ T5324] ? clean_bdev_aliases+0x62e/0x750 [ 133.080945][ T5324] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 133.083364][ T5324] hfsplus_get_block+0x41f/0x1610 [ 133.085589][ T5324] ? __pfx_hfsplus_get_block+0x10/0x10 [ 133.088002][ T5324] ? submit_page_section+0x5b6/0x910 [ 133.090321][ T5324] ? __pfx_hfsplus_get_block+0x10/0x10 [ 133.092547][ T5324] __blockdev_direct_IO+0x1590/0x3380 [ 133.094819][ T5324] ? __pfx___blockdev_direct_IO+0x10/0x10 [ 133.097118][ T5324] ? __pfx_invalidate_inode_pages2_range+0x10/0x10 [ 133.099786][ T5324] ? __pfx_hfsplus_get_block+0x10/0x10 [ 133.102103][ T5324] ? filemap_write_and_wait_range+0x1e9/0x3f0 [ 133.104651][ T5324] ? __pfx_filemap_write_and_wait_range+0x10/0x10 [ 133.107575][ T5324] ? __mod_timer+0xb53/0xed0 [ 133.109520][ T5324] hfsplus_direct_IO+0x21f/0x370 [ 133.111601][ T5324] generic_file_direct_write+0x1d0/0x3f0 [ 133.113974][ T5324] __generic_file_write_iter+0x11d/0x230 [ 133.116412][ T5324] ? generic_file_write_iter+0x9a/0x330 [ 133.118748][ T5324] generic_file_write_iter+0xae/0x330 [ 133.121079][ T5324] iter_file_splice_write+0xa31/0x1240 [ 133.123360][ T5324] ? __pfx_iter_file_splice_write+0x10/0x10 [ 133.125984][ T5324] ? __pfx_iter_file_splice_write+0x10/0x10 [ 133.128574][ T5324] direct_splice_actor+0x101/0x160 [ 133.130869][ T5324] splice_direct_to_actor+0x57b/0xcb0 [ 133.133212][ T5324] ? __pfx_direct_splice_actor+0x10/0x10 [ 133.135630][ T5324] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 133.138204][ T5324] do_splice_direct+0x195/0x290 [ 133.140438][ T5324] ? __pfx_do_splice_direct+0x10/0x10 [ 133.142850][ T5324] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 133.145500][ T5324] ? rw_verify_area+0x203/0x4c0 [ 133.147684][ T5324] do_sendfile+0x52e/0x7c0 [ 133.149457][ T5324] ? __pfx_do_sendfile+0x10/0x10 [ 133.151443][ T5324] ? __se_sys_futex+0x3a8/0x450 [ 133.153495][ T5324] __se_sys_sendfile64+0x144/0x1a0 [ 133.155773][ T5324] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 133.158174][ T5324] do_syscall_64+0x166/0x520 [ 133.160246][ T5324] ? trace_irq_disable+0x3b/0x140 [ 133.162322][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.164950][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 133.167160][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.169714][ T5324] RIP: 0033:0x7fcfa799e159 [ 133.171704][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.180090][ T5324] RSP: 002b:00007fcfa88ebfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 133.183591][ T5324] RAX: ffffffffffffffda RBX: 00007fcfa7c25fa0 RCX: 00007fcfa799e159 [ 133.187043][ T5324] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 133.190577][ T5324] RBP: 00007fcfa7a35024 R08: 0000000000000000 R09: 0000000000000000 [ 133.194115][ T5324] R10: 0000000020fffe89 R11: 0000000000000246 R12: 0000000000000000 [ 133.197761][ T5324] R13: 00007fcfa7c26038 R14: 00007fcfa7c25fa0 R15: 00007ffef9fa8788 [ 133.201294][ T5324] [ 133.214389][ T5325] syz.0.0: attempt to access beyond end of device [ 133.214389][ T5325] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 133.214442][ T5325] Buffer I/O error on dev loop0, logical block 2889, async page read [ 133.214485][ T5325] syz.0.0: attempt to access beyond end of device [ 133.214485][ T5325] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 133.215087][ T5325] Buffer I/O error on dev loop0, logical block 2889, async page read [ 133.218941][ T25] audit: type=1800 audit(1788777074.885:2): pid=5325 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="file1" dev="loop0" ino=20 res=0 errno=0