hfsplus: new node 0 already hashed? ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5007 at fs/hfsplus/bnode.c:671 hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 Modules linked in: CPU: 0 PID: 5007 Comm: syz.4.86 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 lr : hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 sp : ffff800020f06dc0 x29: ffff800020f06de0 x28: 1ffff000041e0dcc x27: dfff800000000000 x26: 0000000000000000 x25: 0000000000000080 x24: 0000000000000000 x23: ffff0000db19ee88 x22: 0000000000000000 x21: ffff0000cc130000 x20: 0000000000000000 x19: ffff0000db19ee00 x18: ffff800011abbcc0 x17: 1fffe00033ed797e x16: ffff8000082d22e0 x15: 0000000040000000 x14: 0000000000000002 x13: 1ffff00002a180b1 x12: 0000000000080000 x11: 00000000000572f4 x10: ffff800027dba000 x9 : 4b403cad1bea5000 x8 : 4b403cad1bea5000 x7 : ffff800008251e10 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000a84592c x2 : ffff00019f6bcd10 x1 : 0000000100000000 x0 : 0000000000000023 Call trace: hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 hfsplus_bmap_alloc+0x4e8/0x590 fs/hfsplus/btree.c:415 hfs_bnode_split+0xc8/0xbb8 fs/hfsplus/brec.c:245 hfsplus_brec_insert+0x2f4/0xaa8 fs/hfsplus/brec.c:100 hfsplus_create_cat+0x31c/0xdd4 fs/hfsplus/catalog.c:292 hfsplus_fill_super+0xf88/0x16c0 fs/hfsplus/super.c:560 mount_bdev+0x264/0x358 fs/super.c:1443 hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641 legacy_get_tree+0xd4/0x16c fs/fs_context.c:632 vfs_get_tree+0x90/0x274 fs/super.c:1573 do_new_mount+0x228/0x810 fs/namespace.c:3069 path_mount+0x5b4/0xe78 fs/namespace.c:3399 do_mount fs/namespace.c:3412 [inline] __do_sys_mount fs/namespace.c:3620 [inline] __se_sys_mount fs/namespace.c:3597 [inline] __arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 3960 hardirqs last enabled at (3959): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline] hardirqs last enabled at (3959): [] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003 hardirqs last disabled at (3960): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (3916): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (3916): [] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624 softirqs last disabled at (3911): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- hfsplus: new node 0 already hashed? ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5007 at fs/hfsplus/bnode.c:671 hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 Modules linked in: CPU: 1 PID: 5007 Comm: syz.4.86 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 lr : hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 sp : ffff800020f06e20 x29: ffff800020f06e40 x28: 1ffff000041e0dd8 x27: dfff800000000000 x26: 0000000000000000 x25: 0000000000000080 x24: 0000000000000000 x23: ffff0000db19ee88 x22: 0000000000000000 x21: ffff0000cc130000 x20: 0000000000000000 x19: ffff0000db19ee00 x18: ffff800011abbcc0 x17: 0000000000000000 x16: ffff8000082d22e0 x15: 0000000000000002 x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000080000 x11: 0000000000074da4 x10: ffff800027dba000 x9 : 4b403cad1bea5000 x8 : 4b403cad1bea5000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800020f068f8 x4 : ffff8000151a4820 x3 : ffff80000a84592c x2 : ffff00019f6ddd10 x1 : 0000000100000000 x0 : 0000000000000023 Call trace: hfsplus_bnode_create+0x40c/0x4c8 fs/hfsplus/bnode.c:670 hfsplus_bmap_alloc+0x4e8/0x590 fs/hfsplus/btree.c:415 hfs_btree_inc_height+0xf8/0x8e0 fs/hfsplus/brec.c:475 hfsplus_brec_insert+0x5c8/0xaa8 fs/hfsplus/brec.c:148 hfsplus_create_cat+0x31c/0xdd4 fs/hfsplus/catalog.c:292 hfsplus_fill_super+0xf88/0x16c0 fs/hfsplus/super.c:560 mount_bdev+0x264/0x358 fs/super.c:1443 hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641 legacy_get_tree+0xd4/0x16c fs/fs_context.c:632 vfs_get_tree+0x90/0x274 fs/super.c:1573 do_new_mount+0x228/0x810 fs/namespace.c:3069 path_mount+0x5b4/0xe78 fs/namespace.c:3399 do_mount fs/namespace.c:3412 [inline] __do_sys_mount fs/namespace.c:3620 [inline] __se_sys_mount fs/namespace.c:3597 [inline] __arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 4302 hardirqs last enabled at (4301): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261 hardirqs last disabled at (4302): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (4224): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (4224): [] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624 softirqs last disabled at (3963): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kernel BUG at fs/hfsplus/bnode.c:716! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 5007 Comm: syz.4.86 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : hfsplus_bnode_put+0x490/0x49c fs/hfsplus/bnode.c:716 lr : hfsplus_bnode_put+0x490/0x49c fs/hfsplus/bnode.c:716 sp : ffff800020f06f20 x29: ffff800020f06f20 x28: ffff0000d2b8d400 x27: dfff800000000000 x26: ffff7000041e0df8 x25: ffff800020f06fc0 x24: 1fffe0001b633dc0 x23: ffff0000cc130000 x22: dfff800000000000 x21: 0000000000000000 x20: ffff0000db19ee80 x19: ffff0000db19ee00 x18: ffff800011abbcc0 x17: 0000000000000000 x16: ffff8000082e7b1c x15: 0000000000000002 x14: 0000000000000001 x13: 1ffff00002a180b1 x12: 0000000000080000 x11: 000000000007ffff x10: ffff800027dba000 x9 : ffff800008f6f140 x8 : 0000000000080000 x7 : ffff8000117f38e4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008f6ed0c x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: hfsplus_bnode_put+0x490/0x49c fs/hfsplus/bnode.c:716 hfs_btree_inc_height+0x48c/0x8e0 fs/hfsplus/brec.c:530 hfsplus_brec_insert+0x5c8/0xaa8 fs/hfsplus/brec.c:148 hfsplus_create_cat+0x31c/0xdd4 fs/hfsplus/catalog.c:292 hfsplus_fill_super+0xf88/0x16c0 fs/hfsplus/super.c:560 mount_bdev+0x264/0x358 fs/super.c:1443 hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641 legacy_get_tree+0xd4/0x16c fs/fs_context.c:632 vfs_get_tree+0x90/0x274 fs/super.c:1573 do_new_mount+0x228/0x810 fs/namespace.c:3069 path_mount+0x5b4/0xe78 fs/namespace.c:3399 do_mount fs/namespace.c:3412 [inline] __do_sys_mount fs/namespace.c:3620 [inline] __se_sys_mount fs/namespace.c:3597 [inline] __arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: aa1403e0 97e59eb1 17ffffb4 97d4c9d7 (d4210000) ---[ end trace 0000000000000000 ]---