Extracting prog: 2m27.114870708s Minimizing prog: 61.25µs Simplifying prog options: 0s Extracting C: 32.340342057s Simplifying C: 7m40.90718712s 1 programs, timeouts [30s 6m0s] extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus detailed listing: executing program 0: syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000100)='./file1\x00', 0xa08800, &(0x7f0000000140)=ANY=[], 0x1, 0x671, &(0x7f0000000a40)="$eJzs3c1rHOcdB/DvrFay5IKjJHbilkBFDGmpqK0XlFa9xO2h6BBKcA+h0Iuw5Vh4rQRJKUooRX2/9pA/ID3oUOip0LshhZ7a3nLVqQQKveSkm8vOzmpXllfZlSWt1Xw+ZnaemWeel/nNzDM7WswE+NJamk79YYosTb+51Vze3Zlv7O7MX6iyG0ma6VpSb81SrCXFJ8nNtKZ8tbmy2r7o1c5Hq4u3Pv1897PW0mRa9ZXb144q15/taspUkpFqftjoseq73bO+oy3vp4r9PWwG7Fo7cDBsjw7ZHqT4U163wLOgaN03D5lMLiYZr74HpBodamfbu5M30CgHAAAA59Rze9nLVi4Nux8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwnlTv/y+qqdZOT6Vov/9/rFqXKn2rNuQ+P42Hw+4AAAAAAAAAAJyAr+9lL1u51F5+1Ppl/9Xy83L5+ZW8n42sZD3Xs5XlbGYz65lNMtlV0djW8ubm+mwfJeeeWHLuLPYWAAAAAAAAAP5v/SpLnd//AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgWVAkI61ZOV1upydTqycZr5aznfwrydiw+zuA4kkrH559PwAAAOCpjB+jzHN72ctWLrWXHxXlM/9L5fPyeN7PWjazms00spI71TN086m/trsz39jdmX+wuzNfNvzTRy2ter7/34G6UdaY1t8entzy1XKLidzNarnmem6XnbmTWlmy6WrVn/3pYCO/bPZp4o1Knz27U82bjf2h118RTkJt0AKTZaHR/YjMVH1rVvT80ZH4wqNTP7Kl2dT2//Jz+YiW2rtUDBjzi+1ySX73WMzf+PefftJnNadgPxK1lJGY6zr7Xjo65sk3/vrnt+811u7fu7sxfWqn0Vl5/JyY74rEy+c6EvUBt58pI3Flf3kpP8yPM52pvJX1rOZnWc5mVlKNjFmuzufm52RXlJJDkbp5YOmtL+rJWHVcWqNoP32ayoUytZxXy7KXspoi7+ZOVvJ6+W8us/lOFrKQxa4jfKXnES73rRxpa4Nd9de+mc6l/vvmSN1fueTv/W44uNYttRnX57vi2j3mTpZ53Ws6UXqhj/vRgGNj/WtVotnGr49z2zg1j0ditisSLx4diT+W18ZGY+3++r3l93rUv/3Y8mujnfRvT/POPLDm+fJCxquR5ODZ0cx7cX+UORivseoXl1Ze7VDelTKvKNpX6o96Xqlj1Xe4wzXNlXkvH84baff8alfege9befcfw4knAAO6+K2LYxP/mfjnxMcTv5m4N/Hm+A8ufPfCK2MZ/dvo9+ozI6/VXin+ko/zi87zPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHwbH3x4f7nRWFl/cqLWO+tkE0X1Ip9e29QzkTPoxlkmimT7xGvO8Perj0T7JYJPW8/bN5+J3TnXiZEk7TUj6WRVh+g4LxcFzoUbmw/eu7HxwYffXn2w/M7KOytrowsLizOLC6/P37i72liZaX0Ou5fAaeh8Hxh2TwAAAAAAAAAAAIB+ncX/NOhqbmqIuwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcU0vTqY+myOzM9Znm8u7OfKM5tdOdLetJarWk+HlSfJLcTGvKZFd1Ra92PlpdvPXp57ufdeqqt7evHVWuP9vVlKkkI9X8kLHj1Xe7V319K/b3sBmwa+3AwbD9LwAA//8WqQVO") program crashed: possible deadlock in hfsplus_get_block single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program extracting C reproducer testing compiled C program (duration=58.064767777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block simplifying C reproducer testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block testing compiled C program (duration=58.064767777s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus program crashed: possible deadlock in hfsplus_get_block reproducing took 10m40.362473346s repro crashed as (corrupted=false): loop0: detected capacity change from 0 to 1024 ============================================ WARNING: possible recursive locking detected 5.15.167-syzkaller #0 Not tainted -------------------------------------------- syz-executor296/4017 is trying to acquire lock: ffff0000cadb9548 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_get_block+0x2c4/0x1194 fs/hfsplus/extents.c:260 but task is already holding lock: ffff0000cadb87c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x198/0x14e0 fs/hfsplus/extents.c:458 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&HFSPLUS_I(inode)->extents_lock); lock(&HFSPLUS_I(inode)->extents_lock); *** DEADLOCK *** May be due to missing lock nesting notation 5 locks held by syz-executor296/4017: #0: ffff0000dad940e0 (&type->s_umount_key#40/1){+.+.}-{3:3}, at: alloc_super+0x1b8/0x844 fs/super.c:229 #1: ffff0000c7d4e198 (&sbi->vh_mutex){+.+.}-{3:3}, at: hfsplus_fill_super+0xf0c/0x167c fs/hfsplus/super.c:553 #2: ffff0000c839a0b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x144/0x1bc fs/hfsplus/bfind.c:28 #3: ffff0000cadb87c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x198/0x14e0 fs/hfsplus/extents.c:458 #4: ffff0000c7d4e0f8 (&sbi->alloc_mutex){+.+.}-{3:3}, at: hfsplus_block_allocate+0x8c/0x800 fs/hfsplus/bitmap.c:35 stack backtrace: CPU: 0 PID: 4017 Comm: syz-executor296 Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 __lock_acquire+0x62bc/0x7638 kernel/locking/lockdep.c:5012 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623 __mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743 hfsplus_get_block+0x2c4/0x1194 fs/hfsplus/extents.c:260 block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290 hfsplus_readpage+0x28/0x38 fs/hfsplus/inode.c:28 do_read_cache_page+0x60c/0x950 read_cache_page+0x68/0x84 mm/filemap.c:3574 read_mapping_page include/linux/pagemap.h:515 [inline] hfsplus_block_allocate+0xe0/0x800 fs/hfsplus/bitmap.c:37 hfsplus_file_extend+0x770/0x14e0 fs/hfsplus/extents.c:469 hfsplus_bmap_reserve+0xec/0x474 fs/hfsplus/btree.c:357 hfsplus_create_cat+0x18c/0x1330 fs/hfsplus/catalog.c:272 hfsplus_fill_super+0xf64/0x167c fs/hfsplus/super.c:560 mount_bdev+0x274/0x370 fs/super.c:1398 hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1528 do_new_mount+0x278/0x8fc fs/namespace.c:3005 path_mount+0x594/0x101c fs/namespace.c:3335 do_mount fs/namespace.c:3348 [inline] __do_sys_mount fs/namespace.c:3556 [inline] __se_sys_mount fs/namespace.c:3533 [inline] __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3533 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 final repro crashed as (corrupted=false): loop0: detected capacity change from 0 to 1024 ============================================ WARNING: possible recursive locking detected 5.15.167-syzkaller #0 Not tainted -------------------------------------------- syz-executor296/4017 is trying to acquire lock: ffff0000cadb9548 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_get_block+0x2c4/0x1194 fs/hfsplus/extents.c:260 but task is already holding lock: ffff0000cadb87c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x198/0x14e0 fs/hfsplus/extents.c:458 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&HFSPLUS_I(inode)->extents_lock); lock(&HFSPLUS_I(inode)->extents_lock); *** DEADLOCK *** May be due to missing lock nesting notation 5 locks held by syz-executor296/4017: #0: ffff0000dad940e0 (&type->s_umount_key#40/1){+.+.}-{3:3}, at: alloc_super+0x1b8/0x844 fs/super.c:229 #1: ffff0000c7d4e198 (&sbi->vh_mutex){+.+.}-{3:3}, at: hfsplus_fill_super+0xf0c/0x167c fs/hfsplus/super.c:553 #2: ffff0000c839a0b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x144/0x1bc fs/hfsplus/bfind.c:28 #3: ffff0000cadb87c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x198/0x14e0 fs/hfsplus/extents.c:458 #4: ffff0000c7d4e0f8 (&sbi->alloc_mutex){+.+.}-{3:3}, at: hfsplus_block_allocate+0x8c/0x800 fs/hfsplus/bitmap.c:35 stack backtrace: CPU: 0 PID: 4017 Comm: syz-executor296 Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 __lock_acquire+0x62bc/0x7638 kernel/locking/lockdep.c:5012 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623 __mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743 hfsplus_get_block+0x2c4/0x1194 fs/hfsplus/extents.c:260 block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290 hfsplus_readpage+0x28/0x38 fs/hfsplus/inode.c:28 do_read_cache_page+0x60c/0x950 read_cache_page+0x68/0x84 mm/filemap.c:3574 read_mapping_page include/linux/pagemap.h:515 [inline] hfsplus_block_allocate+0xe0/0x800 fs/hfsplus/bitmap.c:37 hfsplus_file_extend+0x770/0x14e0 fs/hfsplus/extents.c:469 hfsplus_bmap_reserve+0xec/0x474 fs/hfsplus/btree.c:357 hfsplus_create_cat+0x18c/0x1330 fs/hfsplus/catalog.c:272 hfsplus_fill_super+0xf64/0x167c fs/hfsplus/super.c:560 mount_bdev+0x274/0x370 fs/super.c:1398 hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1528 do_new_mount+0x278/0x8fc fs/namespace.c:3005 path_mount+0x594/0x101c fs/namespace.c:3335 do_mount fs/namespace.c:3348 [inline] __do_sys_mount fs/namespace.c:3556 [inline] __se_sys_mount fs/namespace.c:3533 [inline] __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3533 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584