====================================================== WARNING: possible circular locking dependency detected 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 Not tainted ------------------------------------------------------ syz.6.377/9063 is trying to acquire lock: ffff0000fadfc0b0 (&tree->tree_lock#2/1){+.+.}-{4:4}, at: hfs_find_init+0x148/0x1c8 fs/hfs/bfind.c:-1 but task is already holding lock: ffff0000e785bb78 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_get_block+0x1e4/0x9cc fs/hfs/extent.c:365 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: __mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601 __mutex_lock kernel/locking/mutex.c:746 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798 hfs_extend_file+0xd4/0xf4c fs/hfs/extent.c:397 hfs_bmap_reserve+0xd4/0x3e0 fs/hfs/btree.c:234 __hfs_ext_write_extent+0x19c/0x488 fs/hfs/extent.c:121 __hfs_ext_cache_extent+0x84/0x750 fs/hfs/extent.c:174 hfs_ext_read_extent fs/hfs/extent.c:202 [inline] hfs_extend_file+0x264/0xf4c fs/hfs/extent.c:401 hfs_get_block+0x2e8/0x9cc fs/hfs/extent.c:353 __block_write_begin_int+0x53c/0x15e8 fs/buffer.c:2151 block_write_begin fs/buffer.c:2262 [inline] cont_write_begin+0x62c/0x968 fs/buffer.c:2601 hfs_write_begin+0x7c/0xc4 fs/hfs/inode.c:52 cont_expand_zero fs/buffer.c:2528 [inline] cont_write_begin+0x26c/0x968 fs/buffer.c:2591 hfs_write_begin+0x7c/0xc4 fs/hfs/inode.c:52 hfs_file_truncate+0x158/0x7ec fs/hfs/extent.c:494 hfs_inode_setattr+0x398/0x554 fs/hfs/inode.c:654 notify_change+0x9a4/0xc50 fs/attr.c:552 do_truncate+0x178/0x1f0 fs/open.c:65 do_ftruncate+0x3bc/0x458 fs/open.c:192 do_sys_ftruncate fs/open.c:207 [inline] __do_sys_ftruncate fs/open.c:212 [inline] __se_sys_ftruncate fs/open.c:210 [inline] __arm64_sys_ftruncate+0x90/0xe8 fs/open.c:210 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 -> #0 (&tree->tree_lock#2/1){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3166 [inline] check_prevs_add kernel/locking/lockdep.c:3285 [inline] validate_chain kernel/locking/lockdep.c:3909 [inline] __lock_acquire+0x1728/0x3058 kernel/locking/lockdep.c:5235 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5866 __mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601 __mutex_lock kernel/locking/mutex.c:746 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798 hfs_find_init+0x148/0x1c8 fs/hfs/bfind.c:-1 hfs_ext_read_extent fs/hfs/extent.c:200 [inline] hfs_get_block+0x3d4/0x9cc fs/hfs/extent.c:366 block_read_full_folio+0x2ec/0x824 fs/buffer.c:2427 hfs_read_folio+0x28/0x38 fs/hfs/inode.c:34 filemap_read_folio+0xec/0x2f8 mm/filemap.c:2401 do_read_cache_folio+0x368/0x5c0 mm/filemap.c:3885 do_read_cache_page mm/filemap.c:3951 [inline] read_cache_page+0x6c/0x160 mm/filemap.c:3960 read_mapping_page include/linux/pagemap.h:989 [inline] __hfs_bnode_create+0x3d4/0x6f8 fs/hfs/bnode.c:296 hfs_bnode_find+0x1f0/0xb40 fs/hfs/bnode.c:341 hfs_brec_find+0x124/0x444 fs/hfs/bfind.c:126 hfs_brec_read+0x30/0x124 fs/hfs/bfind.c:165 hfs_cat_find_brec+0x124/0x334 fs/hfs/catalog.c:194 hfs_fill_super+0x3ac/0x584 fs/hfs/super.c:350 get_tree_bdev_flags+0x360/0x414 fs/super.c:1636 get_tree_bdev+0x2c/0x3c fs/super.c:1659 hfs_get_tree+0x28/0x38 fs/hfs/super.c:388 vfs_get_tree+0x90/0x28c fs/super.c:1759 do_new_mount+0x228/0x814 fs/namespace.c:3884 path_mount+0x5b4/0xde0 fs/namespace.c:4211 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount fs/namespace.c:4412 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4412 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&HFS_I(tree->inode)->extents_lock); lock(&tree->tree_lock#2/1); lock(&HFS_I(tree->inode)->extents_lock); lock(&tree->tree_lock#2/1); *** DEADLOCK *** 3 locks held by syz.6.377/9063: #0: ffff0000da8740e0 (&type->s_umount_key#68/1){+.+.}-{4:4}, at: alloc_super+0x1a0/0x80c fs/super.c:344 #1: ffff0000faa2a0b0 (&tree->tree_lock#2){+.+.}-{4:4}, at: hfs_find_init+0x148/0x1c8 fs/hfs/bfind.c:-1 #2: ffff0000e785bb78 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_get_block+0x1e4/0x9cc fs/hfs/extent.c:365 stack backtrace: CPU: 1 UID: 0 PID: 9063 Comm: syz.6.377 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x324/0x32c kernel/locking/lockdep.c:2079 check_noncircular+0x154/0x174 kernel/locking/lockdep.c:2211 check_prev_add kernel/locking/lockdep.c:3166 [inline] check_prevs_add kernel/locking/lockdep.c:3285 [inline] validate_chain kernel/locking/lockdep.c:3909 [inline] __lock_acquire+0x1728/0x3058 kernel/locking/lockdep.c:5235 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5866 __mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601 __mutex_lock kernel/locking/mutex.c:746 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798 hfs_find_init+0x148/0x1c8 fs/hfs/bfind.c:-1 hfs_ext_read_extent fs/hfs/extent.c:200 [inline] hfs_get_block+0x3d4/0x9cc fs/hfs/extent.c:366 block_read_full_folio+0x2ec/0x824 fs/buffer.c:2427 hfs_read_folio+0x28/0x38 fs/hfs/inode.c:34 filemap_read_folio+0xec/0x2f8 mm/filemap.c:2401 do_read_cache_folio+0x368/0x5c0 mm/filemap.c:3885 do_read_cache_page mm/filemap.c:3951 [inline] read_cache_page+0x6c/0x160 mm/filemap.c:3960 read_mapping_page include/linux/pagemap.h:989 [inline] __hfs_bnode_create+0x3d4/0x6f8 fs/hfs/bnode.c:296 hfs_bnode_find+0x1f0/0xb40 fs/hfs/bnode.c:341 hfs_brec_find+0x124/0x444 fs/hfs/bfind.c:126 hfs_brec_read+0x30/0x124 fs/hfs/bfind.c:165 hfs_cat_find_brec+0x124/0x334 fs/hfs/catalog.c:194 hfs_fill_super+0x3ac/0x584 fs/hfs/super.c:350 get_tree_bdev_flags+0x360/0x414 fs/super.c:1636 get_tree_bdev+0x2c/0x3c fs/super.c:1659 hfs_get_tree+0x28/0x38 fs/hfs/super.c:388 vfs_get_tree+0x90/0x28c fs/super.c:1759 do_new_mount+0x228/0x814 fs/namespace.c:3884 path_mount+0x5b4/0xde0 fs/namespace.c:4211 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount fs/namespace.c:4412 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4412 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 hfs: get root inode failed