program: syz_mount_image$hfsplus(&(0x7f0000000280), &(0x7f0000000200)='./file0\x00', 0x0, &(0x7f00000002c0)={[{@nodecompose}]}, 0x1, 0x5ea, &(0x7f0000000680)="$eJzs3U9oHNcdB/DvrGVZ64KjJHaSlkJFDKaNqS1pm9qFQt1Sig6hGHrJVdjrWHitBGlTlFCK+v/aYw45pAf1kFOvKT2Epueeetfd0Lt6KA4zO7taW7KyimXvKv584O17s+/PvPfzzNPuCKMAz6ylN3NyM0WWLr6xUR5vb7U621utu/1yklNJGslUL0uxmhSfJdfSS/l6+WY9XPGo87x+75MPL3zwcatss7n7dtEf9PFWsVmnzCU5UedHNd6Nxx6vGKywDNj5fuBg3O7vsXmY7o953wKToOj93NxjNjmdZKb+HJB6d2g83dkdvUPtcgAAAHBMPbeTnWzkzLjnAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMdJ/ff/izo1+uW5FP2//z9dv5e6fKx9Ou4JAAAAAAAAAMAomgdXf2snO9nImf7x/aL6nf+r1cHZ6vVreTfraWctl7KR5XTTzVoWkszWnf6fZHpjudtdWxih5+JQzwx6Lh7xugEAAAAAAADg2fLbLO3+/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZBkZzoZVU62y/PpjGVZCbJdNluM/lHv3ycfTruCQAAAMBT8NxOdrKRM/3j+0X1nf+l6nv/TN7NarpZSTedtHOzehbQ+9bf2N5qdba3WnfLtHfcH//3UNOoRkzv2cP+Z56vWpwb9FjKz/KLXMxcrmctK/llltNNO3P5aVVaTpHZ+unFbH+e+8/32gNH179orq9UM2nmVlaquV3KjbydTm6mUa2hanPwGX9TRqf4UW3EGN2s83JFf67zyTBbReTkICLzdezLaDzfi8DMIyJxyOvk4TMtpDF4BnX2CcT8dJ2Xsf7jRMd8cejqe+ngSCTf+c8/r9/urN65fWv94uQs6Ut6OBKtoUi8/KhI9Bt8pSIxXUejt4sebrd8tep7Jiv5ed7OzbRzJfNZyNXM5wdZTOuBK+zcCPda43D32vlv14Vmkj/V+WQo4/r8UFyHd7rZqm74nd0ovXD0O9LUN+pCeY7fDV3I4/dwJBaGIvHiwZH4y/3ydb2zemft9vI7I57vQp2Xt+0fJmpvLq+XF8p/rOrowaujrHtx37qFqu7soK6xp+7coO6L7tTp+jPc3pF6dS/vW9eq6l4ZqtvvUw4AE+/0a6enm/ea/25+1Px983bzjZmfnLp66pvTOfmvqb+f+Fvjr40fFq/lo/x69/s/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw5a2/9/6d5U6nvXZg4X8jtFFQUPjqFMa9MwFP2uXu3Xcur7/3/ndX7i6/1X6rvbp49crVK63vL3zv8q2VTnu+9zruWQJPwu4P/XHPBAAAAAAAAAAAABjV0/jvBONeIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHC8Lb2Zk5spsjB/ab483t5qdcrUL++2nErSSFL8Kik+S66llzI7NFzxqPO8fu+TDy988HFrd6ypfvvGQf1Gs1mnzCU5UedHNd6Nxx6vGKywDNj5fuBg3D4PAAD//2cQEK4=") truncate(&(0x7f0000000080)='./file2\x00', 0x6002) r0 = open(&(0x7f00000000c0)='./file2\x00', 0x24842, 0x80) r1 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000020000082505a1a440000102030109025c000201"], 0x0) r2 = openat$nmem0(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000240)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x13, 0xf, &(0x7f0000000500)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x12}}) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x800) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x13, 0x1, "ef359f418ab93852f7d6a4ae6dddfbd14e5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f20000000000d3efe5d6ff010093f4000000000100", [0x100000008]}) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x1}], 0x1, 0x9c00, 0x7, 0x3) mount$bind(&(0x7f0000000100)='./file2\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0x800000, 0x0) [ 86.340901][ T5325] loop0: detected capacity change from 0 to 1024 [ 86.440115][ T5325] [ 86.441244][ T5325] ============================================ [ 86.443925][ T5325] WARNING: possible recursive locking detected [ 86.446576][ T5325] syzkaller #0 Not tainted [ 86.448520][ T5325] -------------------------------------------- [ 86.451161][ T5325] syz.0.0/5325 is trying to acquire lock: [ 86.453613][ T5325] ffff8880524bb300 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_get_block+0x391/0x1610 [ 86.458217][ T5325] [ 86.458217][ T5325] but task is already holding lock: [ 86.461148][ T5325] ffff8880524ba040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 86.465360][ T5325] [ 86.465360][ T5325] other info that might help us debug this: [ 86.468650][ T5325] Possible unsafe locking scenario: [ 86.468650][ T5325] [ 86.471842][ T5325] CPU0 [ 86.473288][ T5325] ---- [ 86.474729][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 86.477200][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 86.479590][ T5325] [ 86.479590][ T5325] *** DEADLOCK *** [ 86.479590][ T5325] [ 86.482881][ T5325] May be due to missing lock nesting notation [ 86.482881][ T5325] [ 86.486167][ T5325] 4 locks held by syz.0.0/5325: [ 86.488246][ T5325] #0: ffff88803ce00450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 86.492291][ T5325] #1: ffff8880524ba1d8 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: do_truncate+0x18f/0x250 [ 86.496601][ T5325] #2: ffff8880524ba040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 86.501006][ T5325] #3: ffff88805249d0f0 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_block_allocate+0xa9/0xd30 [ 86.505192][ T5325] [ 86.505192][ T5325] stack backtrace: [ 86.507736][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.507748][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.507753][ T5325] Call Trace: [ 86.507759][ T5325] [ 86.507763][ T5325] dump_stack_lvl+0xe8/0x150 [ 86.507777][ T5325] print_deadlock_bug+0x279/0x290 [ 86.507785][ T5325] __lock_acquire+0x24df/0x2cf0 [ 86.507795][ T5325] ? lock_release+0x4b/0x3c0 [ 86.507804][ T5325] ? lock_release+0x4b/0x3c0 [ 86.507815][ T5325] ? is_bpf_text_address+0x292/0x2b0 [ 86.507825][ T5325] ? is_bpf_text_address+0x26/0x2b0 [ 86.507835][ T5325] ? kernel_text_address+0xa5/0xe0 [ 86.507842][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 86.507849][ T5325] lock_acquire+0x106/0x350 [ 86.507860][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 86.507872][ T5325] __mutex_lock+0x19d/0x1550 [ 86.507928][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 86.507938][ T5325] ? check_path+0x21/0x40 [ 86.507949][ T5325] ? check_noncircular+0xda/0x150 [ 86.507960][ T5325] ? add_lock_to_list+0xc7/0x100 [ 86.507969][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 86.507978][ T5325] ? __pfx___mutex_lock+0x10/0x10 [ 86.507992][ T5325] hfsplus_get_block+0x391/0x1610 [ 86.508005][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508018][ T5325] ? block_read_full_folio+0x65a/0x810 [ 86.508029][ T5325] block_read_full_folio+0x29f/0x810 [ 86.508041][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508050][ T5325] filemap_read_folio+0x12c/0x3a0 [ 86.508062][ T5325] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 86.508078][ T5325] ? __pfx_filemap_read_folio+0x10/0x10 [ 86.508088][ T5325] ? filemap_add_folio+0x350/0x530 [ 86.508104][ T5325] do_read_cache_folio+0x354/0x590 [ 86.508115][ T5325] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 86.508130][ T5325] read_cache_page+0x5d/0x170 [ 86.508139][ T5325] hfsplus_block_allocate+0xf7/0xd30 [ 86.508153][ T5325] ? lockdep_hardirqs_on+0x7a/0x110 [ 86.508163][ T5325] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 86.508181][ T5325] hfsplus_file_extend+0xb77/0x1df0 [ 86.508193][ T5325] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 86.508202][ T5325] ? blk_mq_submit_bio+0x306/0x2a40 [ 86.508252][ T5325] ? __pfx_blk_mq_submit_bio+0x10/0x10 [ 86.508267][ T5325] ? blk_cgroup_bio_start+0x5d4/0x670 [ 86.508284][ T5325] ? percpu_ref_put+0x1e/0x230 [ 86.508299][ T5325] ? __pfx_blk_cgroup_bio_start+0x10/0x10 [ 86.508308][ T5325] hfsplus_get_block+0x41f/0x1610 [ 86.508316][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508322][ T5325] ? submit_bio_noacct+0xf7b/0x1b20 [ 86.508330][ T5325] ? blkcg_set_ioprio+0x16b/0x2a0 [ 86.508343][ T5325] __block_write_begin_int+0x6c2/0x1900 [ 86.508363][ T5325] ? filemap_add_folio+0x350/0x530 [ 86.508379][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508390][ T5325] ? __pfx___block_write_begin_int+0x10/0x10 [ 86.508404][ T5325] cont_write_begin+0x71b/0xac0 [ 86.508418][ T5325] ? __pfx_cont_write_begin+0x10/0x10 [ 86.508427][ T5325] ? add_lock_to_list+0xc7/0x100 [ 86.508436][ T5325] hfsplus_write_begin+0x66/0xb0 [ 86.508445][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508452][ T5325] cont_write_begin+0x2d6/0xac0 [ 86.508460][ T5325] ? __pfx_cont_write_begin+0x10/0x10 [ 86.508469][ T5325] hfsplus_write_begin+0x66/0xb0 [ 86.508479][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 86.508489][ T5325] generic_cont_expand_simple+0x146/0x210 [ 86.508501][ T5325] ? __pfx_inode_dio_wait+0x10/0x10 [ 86.508514][ T5325] ? __pfx_generic_cont_expand_simple+0x10/0x10 [ 86.508525][ T5325] ? current_time+0x25a/0x380 [ 86.508539][ T5325] ? __pfx_current_time+0x10/0x10 [ 86.508552][ T5325] hfsplus_setattr+0x15f/0x260 [ 86.508562][ T5325] ? __pfx_hfsplus_setattr+0x10/0x10 [ 86.508571][ T5325] notify_change+0xbba/0xea0 [ 86.508586][ T5325] do_truncate+0x1c2/0x250 [ 86.508601][ T5325] ? __pfx_do_truncate+0x10/0x10 [ 86.508614][ T5325] ? apparmor_path_truncate+0x230/0x2c0 [ 86.508633][ T5325] vfs_truncate+0x4b4/0x540 [ 86.508648][ T5325] ? __pfx_vfs_truncate+0x10/0x10 [ 86.508663][ T5325] ? do_getname+0x151/0x250 [ 86.508676][ T5325] ksys_truncate+0xf3/0x1c0 [ 86.508689][ T5325] ? __pfx_ksys_truncate+0x10/0x10 [ 86.508705][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.508717][ T5325] __x64_sys_truncate+0x5b/0x70 [ 86.508731][ T5325] do_syscall_64+0x174/0x580 [ 86.508744][ T5325] ? trace_irq_disable+0x3b/0x140 [ 86.508758][ T5325] ? clear_bhb_loop+0x40/0x90 [ 86.508770][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.508781][ T5325] RIP: 0033:0x7f48f239de99 [ 86.508792][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.508800][ T5325] RSP: 002b:00007f48f325dfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 86.508813][ T5325] RAX: ffffffffffffffda RBX: 00007f48f2625fa0 RCX: 00007f48f239de99 [ 86.508822][ T5325] RDX: 0000000000000000 RSI: 0000000000006002 RDI: 0000200000000080 [ 86.508829][ T5325] RBP: 00007f48f2433eaf R08: 0000000000000000 R09: 0000000000000000 [ 86.508836][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.508843][ T5325] R13: 00007f48f2626038 R14: 00007f48f2625fa0 R15: 00007ffd8cac74f8 [ 86.508853][ T5325] [ 86.720220][ T4652] Bluetooth: hci0: command tx timeout [ 86.736685][ T24] audit: type=1800 audit(1785318652.527:2): pid=5326 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file2" dev="loop0" ino=21 res=0 errno=0 [ 86.983387][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 87.133732][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 87.138125][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.142473][ T9] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 87.148386][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 87.152273][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.156614][ T9] usb 5-1: Product: syz [ 87.158707][ T9] usb 5-1: Manufacturer: syz [ 87.160871][ T9] usb 5-1: SerialNumber: syz [ 87.743366][ T5326] loop0: detected capacity change from 1024 to 64 [ 87.748383][ T5326] syz.0.0: attempt to access beyond end of device [ 87.748383][ T5326] loop0: rw=8388608, sector=94, nr_sectors = 2 limit=64 [ 87.759559][ T5326] Buffer I/O error on dev loop0, logical block 47, async page read [ 87.773595][ T5326] syz.0.0: attempt to access beyond end of device [ 87.773595][ T5326] loop0: rw=8388608, sector=96, nr_sectors = 2 limit=64 [ 87.784014][ T5326] Buffer I/O error on dev loop0, logical block 48, async page read [ 87.790437][ T5326] syz.0.0: attempt to access beyond end of device [ 87.790437][ T5326] loop0: rw=8388608, sector=98, nr_sectors = 2 limit=64 [ 87.801801][ T5326] Buffer I/O error on dev loop0, logical block 49, async page read [ 87.805413][ T5326] syz.0.0: attempt to access beyond end of device [ 87.805413][ T5326] loop0: rw=8388608, sector=100, nr_sectors = 2 limit=64 [ 87.814024][ T5326] Buffer I/O error on dev loop0, logical block 50, async page read [ 87.817222][ T5326] hfsplus: xattr search failed [ 87.819589][ T5326] syz.0.0: attempt to access beyond end of device [ 87.819589][ T5326] loop0: rw=8388608, sector=286, nr_sectors = 2 limit=64 [ 87.930402][ T5323] usb 5-1: USB disconnect, device number 2