REISERFS (device loop4): Using r5 hash to sort names
reiserfs: enabling write barrier flush mode
hfsplus: xattr searching failed
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
======================================================
WARNING: possible circular locking dependency detected
4.19.211-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/27356 is trying to acquire lock:
00000000deee1e4c (&HFSPLUS_I(inode)->extents_lock){+.+.}, at: hfsplus_get_block+0x292/0x960 fs/hfsplus/extents.c:260

but task is already holding lock:
000000000841a6c7 (&sbi->alloc_mutex){+.+.}, at: hfsplus_block_allocate+0xe0/0xa60 fs/hfsplus/bitmap.c:35

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&sbi->alloc_mutex){+.+.}:
       hfsplus_block_free+0xdb/0x5d0 fs/hfsplus/bitmap.c:182
       hfsplus_free_extents+0x228/0x520 fs/hfsplus/extents.c:363
       hfsplus_file_truncate+0xd96/0x1040 fs/hfsplus/extents.c:591
       hfsplus_delete_inode+0x18d/0x220 fs/hfsplus/inode.c:419
       hfsplus_unlink+0x595/0x820 fs/hfsplus/dir.c:405
       hfsplus_rename+0xbe/0x200 fs/hfsplus/dir.c:545
       vfs_rename+0x67e/0x1bc0 fs/namei.c:4479
       do_renameat2+0xb59/0xc70 fs/namei.c:4629
       __do_sys_rename fs/namei.c:4675 [inline]
       __se_sys_rename fs/namei.c:4673 [inline]
       __x64_sys_rename+0x5d/0x80 fs/namei.c:4673
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:937 [inline]
       __mutex_lock+0xd7/0x1190 kernel/locking/mutex.c:1078
       hfsplus_get_block+0x292/0x960 fs/hfsplus/extents.c:260
       block_read_full_page+0x288/0xd10 fs/buffer.c:2259
       do_read_cache_page+0x533/0x1170 mm/filemap.c:2828
       read_mapping_page include/linux/pagemap.h:402 [inline]
       hfsplus_block_allocate+0x197/0xa60 fs/hfsplus/bitmap.c:37
       hfsplus_file_extend+0x436/0xf40 fs/hfsplus/extents.c:468
       hfsplus_get_block+0x196/0x960 fs/hfsplus/extents.c:245
       __block_write_begin_int+0x46c/0x17b0 fs/buffer.c:1978
       __block_write_begin fs/buffer.c:2028 [inline]
       block_write_begin+0x58/0x2e0 fs/buffer.c:2087
       cont_write_begin+0x55a/0x820 fs/buffer.c:2440
       hfsplus_write_begin+0x87/0x150 fs/hfsplus/inode.c:52
       generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3170
       __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3295
       generic_file_write_iter+0x3f8/0x730 mm/filemap.c:3323
       call_write_iter include/linux/fs.h:1821 [inline]
       new_sync_write fs/read_write.c:474 [inline]
       __vfs_write+0x51b/0x770 fs/read_write.c:487
       vfs_write+0x1f3/0x540 fs/read_write.c:549
       ksys_write+0x12b/0x2a0 fs/read_write.c:599
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sbi->alloc_mutex);
                               lock(&HFSPLUS_I(inode)->extents_lock);
                               lock(&sbi->alloc_mutex);
  lock(&HFSPLUS_I(inode)->extents_lock);

 *** DEADLOCK ***

5 locks held by syz-executor.0/27356:
 #0: 00000000567ae16e (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767
 #1: 0000000029388b1f (sb_writers#18){.+.+}, at: file_start_write include/linux/fs.h:2779 [inline]
 #1: 0000000029388b1f (sb_writers#18){.+.+}, at: vfs_write+0x463/0x540 fs/read_write.c:548
 #2: 00000000802fbb4d (&sb->s_type->i_mutex_key#24){+.+.}, at: inode_lock include/linux/fs.h:748 [inline]
 #2: 00000000802fbb4d (&sb->s_type->i_mutex_key#24){+.+.}, at: generic_file_write_iter+0x99/0x730 mm/filemap.c:3320
 #3: 0000000098cdf0f0 (&hip->extents_lock){+.+.}, at: hfsplus_file_extend+0x1bb/0xf40 fs/hfsplus/extents.c:457
 #4: 000000000841a6c7 (&sbi->alloc_mutex){+.+.}, at: hfsplus_block_allocate+0xe0/0xa60 fs/hfsplus/bitmap.c:35

stack backtrace:
CPU: 1 PID: 27356 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2420 [inline]
 __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 __mutex_lock_common kernel/locking/mutex.c:937 [inline]
 __mutex_lock+0xd7/0x1190 kernel/locking/mutex.c:1078
 hfsplus_get_block+0x292/0x960 fs/hfsplus/extents.c:260
 block_read_full_page+0x288/0xd10 fs/buffer.c:2259
audit: type=1804 audit(1677801525.534:400): pid=27331 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/599/bus" dev="sda1" ino=15233 res=1
 do_read_cache_page+0x533/0x1170 mm/filemap.c:2828
 read_mapping_page include/linux/pagemap.h:402 [inline]
 hfsplus_block_allocate+0x197/0xa60 fs/hfsplus/bitmap.c:37
audit: type=1800 audit(1677801525.534:401): pid=27331 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15233 res=0
 hfsplus_file_extend+0x436/0xf40 fs/hfsplus/extents.c:468
 hfsplus_get_block+0x196/0x960 fs/hfsplus/extents.c:245
 __block_write_begin_int+0x46c/0x17b0 fs/buffer.c:1978
 __block_write_begin fs/buffer.c:2028 [inline]
 block_write_begin+0x58/0x2e0 fs/buffer.c:2087
 cont_write_begin+0x55a/0x820 fs/buffer.c:2440
 hfsplus_write_begin+0x87/0x150 fs/hfsplus/inode.c:52
 generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3170
 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3295
 generic_file_write_iter+0x3f8/0x730 mm/filemap.c:3323
 call_write_iter include/linux/fs.h:1821 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x51b/0x770 fs/read_write.c:487
 vfs_write+0x1f3/0x540 fs/read_write.c:549
 ksys_write+0x12b/0x2a0 fs/read_write.c:599
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff2009750f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff1feee7168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff200a94f80 RCX: 00007ff2009750f9
RDX: 000000000208e24b RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007ff2009d0ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
F2FS-fs (loop3): Found nat_bits in checkpoint
R13: 00007ffc967c6def R14: 00007ff1feee7300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 27390 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159
 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180
 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline]
 sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71
 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
attempt to access beyond end of device
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
loop3: rw=2049, want=53384, limit=40427
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
hfsplus: xattr searching failed
hfsplus: xattr searching failed
REISERFS (device loop4): checking transaction log (loop4)
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
REISERFS (device loop4): Using r5 hash to sort names
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
hfsplus: xattr searching failed
hfsplus: xattr searching failed
audit: type=1804 audit(1677801526.724:402): pid=27385 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/600/bus" dev="sda1" ino=15735 res=1
audit: type=1800 audit(1677801526.724:403): pid=27385 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15735 res=0
audit: type=1804 audit(1677801526.754:404): pid=27385 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/600/bus" dev="sda1" ino=15735 res=1
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 27448 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159
 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180
 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline]
 sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71
 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
F2FS-fs (loop3): Found nat_bits in checkpoint
F2FS-fs (loop0): Found nat_bits in checkpoint
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
attempt to access beyond end of device
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
loop3: rw=2049, want=53384, limit=40427
audit: type=1804 audit(1677801527.524:405): pid=27471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/601/bus" dev="sda1" ino=15805 res=1
audit: type=1800 audit(1677801527.524:406): pid=27471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15805 res=0
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
audit: type=1804 audit(1677801527.524:407): pid=27471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/601/bus" dev="sda1" ino=15805 res=1
audit: type=1800 audit(1677801527.524:408): pid=27471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15805 res=0
audit: type=1804 audit(1677801527.524:409): pid=27471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir175410100/syzkaller.WVgoBZ/601/bus" dev="sda1" ino=15805 res=1
attempt to access beyond end of device
loop0: rw=2049, want=53384, limit=40427
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 27520 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159
 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180
 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline]
 sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71
 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
F2FS-fs (loop3): Found nat_bits in checkpoint
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
attempt to access beyond end of device
loop0: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 27573 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159
 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180
 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline]
 sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71
 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
attempt to access beyond end of device
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
loop3: rw=2049, want=53384, limit=40427
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
attempt to access beyond end of device
loop0: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 27622 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x284/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_transport_new+0x71/0x710 net/sctp/transport.c:111
 sctp_assoc_add_peer+0x2a6/0x1050 net/sctp/associola.c:636
 __sctp_connect+0x249/0xd00 net/sctp/socket.c:1237
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
attempt to access beyond end of device
loop0: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
REISERFS (device loop4): checking transaction log (loop4)
CPU: 0 PID: 27679 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
REISERFS (device loop4): Using r5 hash to sort names
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159
 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180
 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline]
 sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71
 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
f2fs_msg: 9 callbacks suppressed
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 27725 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x3f/0x370 mm/slab.c:3557
 radix_tree_node_alloc.constprop.0+0x7c/0x320 lib/radix-tree.c:421
 idr_get_free+0x50e/0xa10 lib/radix-tree.c:2158
 idr_alloc_u32+0x1a5/0x320 lib/idr.c:49
 idr_alloc_cyclic+0x102/0x230 lib/idr.c:128
 sctp_assoc_set_id+0x138/0x1b0 net/sctp/associola.c:1657
 __sctp_connect+0x93f/0xd00 net/sctp/socket.c:1253
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
F2FS-fs (loop3): Found nat_bits in checkpoint
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
attempt to access beyond end of device
loop0: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
CPU: 1 PID: 27770 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
REISERFS (device loop4): checking transaction log (loop4)
 __should_failslab+0x115/0x180 mm/failslab.c:32
REISERFS (device loop4): Using r5 hash to sort names
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x6d/0x3c0 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 sctp_bind_addrs_to_raw+0x109/0x320 net/sctp/bind_addr.c:249
 sctp_make_init+0x11e/0xc30 net/sctp/sm_make_chunk.c:249
 sctp_sf_do_prm_asoc+0xbb/0x340 net/sctp/sm_statefuns.c:4870
 sctp_do_sm+0x162/0x5110 net/sctp/sm_sideeffect.c:1167
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
 sctp_primitive_ASSOCIATE+0x98/0xc0 net/sctp/primitive.c:88
 __sctp_connect+0x968/0xd00 net/sctp/socket.c:1258
 __sctp_setsockopt_connectx+0x132/0x1c0 net/sctp/socket.c:1381
 sctp_getsockopt_connectx3 net/sctp/socket.c:1466 [inline]
 sctp_getsockopt+0x1af7/0x5db0 net/sctp/socket.c:7471
 __sys_getsockopt+0x135/0x210 net/socket.c:2050
 __do_sys_getsockopt net/socket.c:2061 [inline]
 __se_sys_getsockopt net/socket.c:2058 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb3d974e0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
F2FS-fs (loop3): Found nat_bits in checkpoint
RSP: 002b:00007fb3d7c9f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007fb3d986e050 RCX: 00007fb3d974e0f9
RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005
RBP: 00007fb3d7c9f1d0 R08: 0000000020000140 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffee053f04f R14: 00007fb3d7c9f300 R15: 0000000000022000
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
F2FS-fs (loop0): Found nat_bits in checkpoint
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427
attempt to access beyond end of device
loop0: rw=2049, want=45104, limit=40427
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop4): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop4): checking transaction log (loop4)
REISERFS (device loop4): Using r5 hash to sort names
reiserfs: enabling write barrier flush mode
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
attempt to access beyond end of device
loop3: rw=2049, want=53384, limit=40427
attempt to access beyond end of device
loop3: rw=2049, want=45104, limit=40427