====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Not tainted ------------------------------------------------------ syz-executor.1/10625 is trying to acquire lock: ffff88804cc220f8 (&sbi->alloc_mutex){+.+.}-{3:3} , at: hfsplus_block_allocate+0xe5/0x990 fs/hfsplus/bitmap.c:35 but task is already holding lock: ffff888025931c08 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x1c1/0x1090 fs/hfsplus/extents.c:457 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x175/0x9d0 kernel/locking/mutex.c:747 hfsplus_get_block+0x277/0x9e0 fs/hfsplus/extents.c:260 block_read_full_folio+0x3df/0xaa0 fs/buffer.c:2399 filemap_read_folio+0xe9/0x2c0 mm/filemap.c:2323 do_read_cache_folio+0x205/0x540 mm/filemap.c:3700 do_read_cache_page mm/filemap.c:3766 [inline] read_cache_page+0x5b/0x160 mm/filemap.c:3775 read_mapping_page include/linux/pagemap.h:871 [inline] hfsplus_block_allocate+0x144/0x990 fs/hfsplus/bitmap.c:37 hfsplus_file_extend+0x440/0x1090 fs/hfsplus/extents.c:468 hfsplus_get_block+0x1ae/0x9e0 fs/hfsplus/extents.c:245 get_more_blocks fs/direct-io.c:647 [inline] do_direct_IO fs/direct-io.c:935 [inline] __blockdev_direct_IO+0x244c/0x3cc0 fs/direct-io.c:1248 blockdev_direct_IO include/linux/fs.h:3038 [inline] hfsplus_direct_IO+0x10c/0x2c0 fs/hfsplus/inode.c:135 generic_file_direct_write+0x132/0x360 mm/filemap.c:3852 __generic_file_write_iter+0x11d/0x240 mm/filemap.c:4008 generic_file_write_iter+0xe3/0x350 mm/filemap.c:4048 call_write_iter include/linux/fs.h:2020 [inline] aio_write+0x3ba/0x8d0 fs/aio.c:1582 __io_submit_one fs/aio.c:1954 [inline] io_submit_one+0x11af/0x1de0 fs/aio.c:2001 __do_compat_sys_io_submit fs/aio.c:2102 [inline] __se_compat_sys_io_submit fs/aio.c:2072 [inline] __ia32_compat_sys_io_submit+0x1d4/0x3c0 fs/aio.c:2072 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:321 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:346 entry_SYSENTER_compat_after_hwframe+0x70/0x7a -> #0 (&sbi->alloc_mutex){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x2433/0x3b20 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1ae/0x520 kernel/locking/lockdep.c:5719 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x175/0x9d0 kernel/locking/mutex.c:747 hfsplus_block_allocate+0xe5/0x990 fs/hfsplus/bitmap.c:35 hfsplus_file_extend+0x440/0x1090 fs/hfsplus/extents.c:468 hfsplus_bmap_reserve+0x318/0x410 fs/hfsplus/btree.c:358 hfsplus_rename_cat+0x2ad/0x1230 fs/hfsplus/catalog.c:456 hfsplus_rename+0x118/0x200 fs/hfsplus/dir.c:552 vfs_rename+0xe23/0x1c30 fs/namei.c:4844 do_renameat2+0xc3c/0xdc0 fs/namei.c:4996 __do_sys_rename fs/namei.c:5042 [inline] __se_sys_rename fs/namei.c:5040 [inline] __ia32_sys_rename+0x80/0xa0 fs/namei.c:5040 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:321 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:346 entry_SYSENTER_compat_after_hwframe+0x70/0x7a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&HFSPLUS_I(inode)->extents_lock); lock(&sbi->alloc_mutex); lock(&HFSPLUS_I(inode)->extents_lock); lock(&sbi->alloc_mutex); *** DEADLOCK *** 6 locks held by syz-executor.1/10625: #0: ffff888023a96418 (sb_writers#14){.+.+}-{0:0}, at: do_renameat2+0x3d5/0xdc0 fs/namei.c:4930 #1: ffff888025933240 (&type->i_mutex_dir_key#9/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:837 [inline] #1: ffff888025933240 (&type->i_mutex_dir_key#9/1){+.+.}-{3:3}, at: lock_rename fs/namei.c:3046 [inline] #1: ffff888025933240 (&type->i_mutex_dir_key#9/1){+.+.}-{3:3}, at: lock_rename fs/namei.c:3043 [inline] #1: ffff888025933240 (&type->i_mutex_dir_key#9/1){+.+.}-{3:3}, at: do_renameat2+0xb25/0xdc0 fs/namei.c:4935 #2: ffff888025933900 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:837 [inline] #2: ffff888025933900 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: lock_two_inodes+0xfa/0x1e0 fs/inode.c:1129 #3: ffff888025933fc0 (&sb->s_type->i_mutex_key#21/4){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:837 [inline] #3: ffff888025933fc0 (&sb->s_type->i_mutex_key#21/4){+.+.}-{3:3}, at: lock_two_inodes+0x10f/0x1e0 fs/inode.c:1131 #4: ffff8880224d20b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x1a3/0x200 fs/hfsplus/bfind.c:30 #5: ffff888025931c08 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x1c1/0x1090 fs/hfsplus/extents.c:457 stack backtrace: CPU: 1 PID: 10625 Comm: syz-executor.1 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 check_noncircular+0x317/0x400 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x2433/0x3b20 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1ae/0x520 kernel/locking/lockdep.c:5719 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x175/0x9d0 kernel/locking/mutex.c:747 hfsplus_block_allocate+0xe5/0x990 fs/hfsplus/bitmap.c:35 hfsplus_file_extend+0x440/0x1090 fs/hfsplus/extents.c:468 hfsplus_bmap_reserve+0x318/0x410 fs/hfsplus/btree.c:358 hfsplus_rename_cat+0x2ad/0x1230 fs/hfsplus/catalog.c:456 hfsplus_rename+0x118/0x200 fs/hfsplus/dir.c:552 vfs_rename+0xe23/0x1c30 fs/namei.c:4844 do_renameat2+0xc3c/0xdc0 fs/namei.c:4996 __do_sys_rename fs/namei.c:5042 [inline] __se_sys_rename fs/namei.c:5040 [inline] __ia32_sys_rename+0x80/0xa0 fs/namei.c:5040 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:321 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:346 entry_SYSENTER_compat_after_hwframe+0x70/0x7a RIP: 0023:0xf7f6c579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f7f465ac EFLAGS: 00000292 ORIG_RAX: 0000000000000026 RAX: ffffffffffffffda RBX: 0000000020000800 RCX: 0000000020000840 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 10 06 adc %al,(%rsi) 2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 6: 10 07 adc %al,(%rdi) 8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi c: 10 08 adc %cl,(%rax) e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 1e: 00 51 52 add %dl,0x52(%rcx) 21: 55 push %rbp 22: 89 e5 mov %esp,%ebp 24: 0f 34 sysenter 26: cd 80 int $0x80 * 28: 5d pop %rbp <-- trapping instruction 29: 5a pop %rdx 2a: 59 pop %rcx 2b: c3 ret 2c: 90 nop 2d: 90 nop 2e: 90 nop 2f: 90 nop 30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi