program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48) syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") r1 = creat(&(0x7f0000000380)='./bus\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000140)='./mnt\x00', 0x2200454, &(0x7f0000000040)={[{@user_xattr}, {@nodelalloc}]}, 0x1, 0x244, &(0x7f0000000540)="$eJzs3DFoFXccB/Df3XuvadJHSdulUGgLpZQ2ENKt0CVdWgiUEEoptIWUIi5KIsQEt8TJxUFnlUwuQdyMjpIluCiCU9QMcRE0OCQ46PDk3iUSzQsKl7wT7/OBS+7e+//v9z/uff/3hncXQGX1R8RwRNQiYiAiGhGR7Gzwdb70b23O9y6PR7RafzxJ2u3y7dx2v48iYi4ifoqIpTSJI/WImcV/1p6u/Pbd6enGtxcX/+7t6kFuWV9b/X3zwuipKyM/zty682g0ieFovnJc+y/p8Fo9ifj0IIq9I5J62SPgbYyduHw3y/1nEfFNO/+NSCM/eWemPlhqxA/n9+p79vHtL7o5VmD/tVqN7Bo41wIqJ42IZiTpYETk62k6OJh/h79X60uPTk4dHzg8OT1xqOyZCtgvzYjVX6/1XN14Lf8Pa3n+gfdXlv8/xxbuZ+ubtbJHA3RTlv+B/2a/D/mHypF/qC75h+qSf6gu+Yfqkn+orj3yv/0z/7SscQEHz/Ufqkv+obrkH6prZ/4BgGpp9ZR9BzJQlrLnHwAAAAAAAAAAAAAAAAAAYLf53uXx7aVbNW+ci1j/JSLqnerXth5C/GH7b99GkjV7Kcm7FfLvVwV3UNClku++/vhBufVvfllu/dmJiLmTETFUr+/+/CWFH4L9yRveb/xfsEBBP/9Vbv3nC+XWH1mJuJ7NP0Od5p80Pm//7zz/NLPzV7D+sWcFdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDXvAgAAP//DkFuIw==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r2, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x7, 0x1000, 0x1000000007}) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r3, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r1, &(0x7f0000000000), 0xfffffffe, 0x16}]) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x14, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}}, 0x48044) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r4, 0xc0c0128e, &(0x7f0000000240)={0x4000000000002000, 0x2}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005e00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}], 0x10}}], 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x2, 0x17, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000fcff1f00000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000fbe3404dbd94a323a4d6060000008500000005000000980900000000000066090600000003e7040000000600000018010000756c6c2500000000002020207b9af8ff00000000ac9100000000000237010000f8ffffffb702000008000000b70300000000000014000000060000005d93000000000000b5030200000000008500000019000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb4) [ 93.690612][ T5276] Bluetooth: hci0: command tx timeout [ 93.835684][ T5315] loop0: detected capacity change from 0 to 1024 [ 93.956131][ T5315] syz.0.0: attempt to access beyond end of device [ 93.956131][ T5315] loop0: rw=8388608, sector=5778, nr_sectors = 2 limit=1024 [ 94.001653][ T5315] [ 94.002729][ T5315] ====================================================== [ 94.005586][ T5315] WARNING: possible circular locking dependency detected [ 94.008363][ T5315] syzkaller #0 Not tainted [ 94.010063][ T5315] ------------------------------------------------------ [ 94.012813][ T5315] syz.0.0/5315 is trying to acquire lock: [ 94.015608][ T5315] ffff888012e48740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.020551][ T5315] [ 94.020551][ T5315] but task is already holding lock: [ 94.023381][ T5315] ffff8880127720a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.027113][ T5315] [ 94.027113][ T5315] which lock already depends on the new lock. [ 94.027113][ T5315] [ 94.030826][ T5315] [ 94.030826][ T5315] the existing dependency chain (in reverse order) is: [ 94.034016][ T5315] [ 94.034016][ T5315] -> #1 (&tree->tree_lock/1){+.+.}-{4:4}: [ 94.036918][ T5315] __mutex_lock+0x19d/0x1550 [ 94.040020][ T5315] hfsplus_find_init+0x179/0x2e0 [ 94.042204][ T5315] hfsplus_file_truncate+0x3e0/0xd20 [ 94.044402][ T5315] hfsplus_write_begin+0x17b/0x1e0 [ 94.046625][ T5315] cont_write_begin+0x7b2/0xac0 [ 94.048759][ T5315] hfsplus_write_begin+0x126/0x1e0 [ 94.051167][ T5315] generic_perform_write+0x2d5/0x8f0 [ 94.053360][ T5315] generic_file_write_iter+0xae/0x330 [ 94.055929][ T5315] do_iter_readv_writev+0x612/0x8c0 [ 94.058100][ T5315] vfs_writev+0x343/0x990 [ 94.059920][ T5315] __se_sys_pwritev2+0x177/0x2a0 [ 94.061909][ T5315] do_syscall_64+0x166/0x520 [ 94.064175][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.066780][ T5315] [ 94.066780][ T5315] -> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}: [ 94.070421][ T5315] __lock_acquire+0x1520/0x2cf0 [ 94.072611][ T5315] lock_acquire+0x106/0x350 [ 94.074568][ T5315] __mutex_lock+0x19d/0x1550 [ 94.076713][ T5315] hfsplus_file_extend+0x21c/0x1df0 [ 94.079282][ T5315] hfsplus_bmap_reserve+0x170/0x590 [ 94.081619][ T5315] __hfsplus_ext_write_extent+0x295/0x690 [ 94.084294][ T5315] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.087618][ T5315] hfsplus_file_extend+0x502/0x1df0 [ 94.090444][ T5315] hfsplus_get_block+0x41f/0x1610 [ 94.092916][ T5315] __block_write_begin_int+0x6c2/0x1900 [ 94.095766][ T5315] cont_write_begin+0x71b/0xac0 [ 94.098098][ T5315] hfsplus_write_begin+0x126/0x1e0 [ 94.100592][ T5315] generic_perform_write+0x2d5/0x8f0 [ 94.103145][ T5315] generic_file_write_iter+0xae/0x330 [ 94.105710][ T5315] aio_write+0x5d0/0x870 [ 94.108108][ T5315] io_submit_one+0x798/0x13d0 [ 94.110753][ T5315] __se_sys_io_submit+0x195/0x340 [ 94.113155][ T5315] do_syscall_64+0x166/0x520 [ 94.115401][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.118535][ T5315] [ 94.118535][ T5315] other info that might help us debug this: [ 94.118535][ T5315] [ 94.122911][ T5315] Possible unsafe locking scenario: [ 94.122911][ T5315] [ 94.126119][ T5315] CPU0 CPU1 [ 94.128499][ T5315] ---- ---- [ 94.130874][ T5315] lock(&tree->tree_lock/1); [ 94.133009][ T5315] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.136690][ T5315] lock(&tree->tree_lock/1); [ 94.139834][ T5315] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.142168][ T5315] [ 94.142168][ T5315] *** DEADLOCK *** [ 94.142168][ T5315] [ 94.145689][ T5315] locks held by syz.0.0/5315: 3, last CPU#0: [ 94.148320][ T5315] #0: ffff888012e461d8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 94.153108][ T5315] #1: ffff888012e46040 (&hip->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.157074][ T5315] #2: ffff8880127720a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 94.161413][ T5315] [ 94.161413][ T5315] stack backtrace: [ 94.163973][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.163989][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.163997][ T5315] Call Trace: [ 94.164005][ T5315] [ 94.164012][ T5315] dump_stack_lvl+0xe8/0x150 [ 94.164032][ T5315] print_circular_bug+0x2e1/0x300 [ 94.164050][ T5315] check_noncircular+0x12e/0x150 [ 94.164065][ T5315] __lock_acquire+0x1520/0x2cf0 [ 94.164082][ T5315] ? rcu_is_watching+0x16/0xb0 [ 94.164093][ T5315] ? lock_release+0x4b/0x3c0 [ 94.164111][ T5315] ? lock_release+0x4b/0x3c0 [ 94.164130][ T5315] ? is_bpf_text_address+0x292/0x2b0 [ 94.164143][ T5315] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.164159][ T5315] lock_acquire+0x106/0x350 [ 94.164176][ T5315] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.164190][ T5315] __mutex_lock+0x19d/0x1550 [ 94.164202][ T5315] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.164216][ T5315] ? stack_trace_save+0xa9/0x100 [ 94.164238][ T5315] ? __pfx_stack_trace_save+0x10/0x10 [ 94.164252][ T5315] ? check_path+0x21/0x40 [ 94.164261][ T5315] ? hfsplus_file_extend+0x21c/0x1df0 [ 94.164274][ T5315] ? __pfx___mutex_lock+0x10/0x10 [ 94.164285][ T5315] ? add_lock_to_list+0xc7/0x100 [ 94.164297][ T5315] ? stack_depot_save_flags+0x404/0x7f0 [ 94.164368][ T5315] hfsplus_file_extend+0x21c/0x1df0 [ 94.164387][ T5315] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.164403][ T5315] ? __pfx___mutex_trylock_common+0x10/0x10 [ 94.164416][ T5315] ? rcu_is_watching+0x16/0xb0 [ 94.164426][ T5315] ? trace_contention_end+0x3d/0x140 [ 94.164438][ T5315] ? __asan_memset+0x22/0x50 [ 94.164449][ T5315] ? hfsplus_brec_find+0x19a/0x510 [ 94.164462][ T5315] hfsplus_bmap_reserve+0x170/0x590 [ 94.164481][ T5315] __hfsplus_ext_write_extent+0x295/0x690 [ 94.164496][ T5315] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 94.164510][ T5315] ? hfsplus_find_init+0x179/0x2e0 [ 94.164521][ T5315] hfsplus_file_extend+0x502/0x1df0 [ 94.164536][ T5315] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 94.164551][ T5315] ? clean_bdev_aliases+0x62e/0x750 [ 94.164567][ T5315] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 94.164582][ T5315] hfsplus_get_block+0x41f/0x1610 [ 94.164598][ T5315] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.164612][ T5315] ? do_raw_spin_unlock+0x4d/0x200 [ 94.164625][ T5315] ? _raw_spin_unlock+0x28/0x50 [ 94.164634][ T5315] ? create_empty_buffers+0x460/0x520 [ 94.164648][ T5315] __block_write_begin_int+0x6c2/0x1900 [ 94.164665][ T5315] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.164678][ T5315] ? __pfx___block_write_begin_int+0x10/0x10 [ 94.164694][ T5315] cont_write_begin+0x71b/0xac0 [ 94.164706][ T5315] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.164720][ T5315] ? __pfx_cont_write_begin+0x10/0x10 [ 94.164733][ T5315] ? rcu_is_watching+0x16/0xb0 [ 94.164745][ T5315] hfsplus_write_begin+0x126/0x1e0 [ 94.164757][ T5315] ? __pfx_hfsplus_get_block+0x10/0x10 [ 94.164773][ T5315] generic_perform_write+0x2d5/0x8f0 [ 94.164786][ T5315] ? __pfx_generic_perform_write+0x10/0x10 [ 94.164797][ T5315] ? file_update_time_flags+0x1e0/0x440 [ 94.164808][ T5315] ? __generic_file_write_iter+0xf9/0x230 [ 94.164817][ T5315] ? generic_file_write_iter+0x9a/0x330 [ 94.164828][ T5315] generic_file_write_iter+0xae/0x330 [ 94.164840][ T5315] aio_write+0x5d0/0x870 [ 94.164852][ T5315] ? __pfx_aio_write+0x10/0x10 [ 94.164867][ T5315] ? __might_fault+0xaf/0x130 [ 94.164885][ T5315] io_submit_one+0x798/0x13d0 [ 94.164896][ T5315] ? lockdep_hardirqs_on+0x7b/0x110 [ 94.164907][ T5315] ? irqentry_exit+0x218/0x910 [ 94.164918][ T5315] ? __pfx_io_submit_one+0x10/0x10 [ 94.164928][ T5315] ? __might_fault+0xaf/0x130 [ 94.164944][ T5315] ? __might_fault+0xaf/0x130 [ 94.164960][ T5315] __se_sys_io_submit+0x195/0x340 [ 94.164971][ T5315] ? __pfx___se_sys_io_submit+0x10/0x10 [ 94.164985][ T5315] do_syscall_64+0x166/0x520 [ 94.164996][ T5315] ? trace_irq_disable+0x3b/0x140 [ 94.165008][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.165019][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 94.165031][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.165041][ T5315] RIP: 0033:0x7f9b2ad9e0d9 [ 94.165053][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.165062][ T5315] RSP: 002b:00007f9b2bc8dfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 94.165076][ T5315] RAX: ffffffffffffffda RBX: 00007f9b2b025fa0 RCX: 00007f9b2ad9e0d9 [ 94.165084][ T5315] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f9b2bc44000 [ 94.165092][ T5315] RBP: 00007f9b2ae35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.165098][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.165104][ T5315] R13: 00007f9b2b026038 R14: 00007f9b2b025fa0 R15: 00007fff781121e8 [ 94.165115][ T5315]