program: syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=@newlink={0x20, 0x10, 0x100, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2400, 0x4100}}, 0x20}}, 0x4000000) syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x645, &(0x7f0000000580)="$eJzs3c1rHOcdB/DvrNay1gFHaWzHLYGIGNJSUVsvKK16qVtKUSGUkB56FraMhddOKilFCaVR3+i1h/wB6UG3ngq9FAqC9NzectUxUOglJ+W0ZWZn9WLJ6m689srN52Nm5nnmmXnm9/x2XnbXiA3wpbU0neZOiixNv7FZ1ne359u72/P3e+Uk55M0kmZ3keJBUnyc3Ex3ylfLlXV3xaOO8+Hq4luffLb7abfWrKdq+8Zp+/Vnq54ylWSsXg6rv1uP3V+xP8IyYdd6iYNRO5ekc8TPrxy0nO7CY1+3wFlQVM/Ng2u+U1/Zk9Vlnon6fUD3qdh9Zj/Ttj4fdQQAAAAwZBPHVz2/l71s5uIowgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBnVff3/1P96v/E/qoUUyl6v/8/3mtP8twIQz3deH+b7TSedCAAAAAAAAAAMFRF84SVr+xlL5u52Kt3ijSSvFpVLlXz5/Ju1rOStVzPZpazkY2sZTbJ5KGOxjeXNzbWZvvYc+7EPef6HEVr8IEDAAAAAAAAwJfAb7J08P//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwFhTJWHdRTZd65ck0mkkmkoyX220l/+qVn2U7ow4AAAAAnoLn97KXzVzs1TtF9Zn/SvW5fyLv5kE2spqNtLOS29V3Ad1P/Y3d7fn27vb8/XI63u/3/zNQGFWP6X73cPKRr1ZbtHInq9Wa67mVt9PO7TSqPUtXe/GcHNevy5iK79X6jOx2vSxH/sd6eczYQIPtQz8dTlYZObefkZk6tjIbL5yeiaOvztagR5pNY/+bn0tPIOcX6mWRPPfjR+V8JOpMvJI6E3OHzr4rp2ci+fpf//yzu+0H9+7eWZ8+O0MawPlOp9MrP3xOzB/KxEv/95k4bKbKxOX9+lJ+lJ9mOlN5M2tZzS+ynI2sZCo/rErL9flczidPz9TNI7U3q3nr0ZGM169L9+4xWEyvVvtezGp+krdzOyt5vfo3l9l8OwtZyOKhV/hyH1d9Y7Cr/to36kI5wD+cPtCnrMzrC3VeP0iO3HMnq7bDaw6ylCLDvjc2v1YXymP8tl6eDQ9nYvZQJl48/Xz5U3VbWW8/uLd2d/mdPo/3Wr0sr6Pfn6mnRHm+fKV8sara0bOjbHvxxLbZqu3SflvjWNvl/bb/daWO1+/hjvc0V7W9dGLbfNV29VDbSe+3ADjzLnzzwnjr361/tj5q/a51t/XGxA/Of+f8y+M5949z323OjL3WeLn4Sz7Krw4+/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/c+nvv31tut1fWHip0Op0PHtH0RQtjGWSvv/9tmEfv/R7REIcz3MLEIBt3zkbMgxQ+73Q6Q+lw65STdmiFTu1MpG5EhRHfmIAn7sbG/XdurL/3/rdWe4/IhYXFmcWF1+dv3Fltr8x05yMOEngiDh76o44EAAAAAAAAAAAA6NfT+HOCUY8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeLYtTae5kyKzM9dnyvru9ny7nHrlgy2bSRpJil8mxcfJzXSnTB7qrjh+hJ1q/uHq4luffLb76UFfzd72jZP3G8RWd2pVlbEkU0Ppr9vPrcfur9gfYZmwa73Ewaj9NwAA//9OthFo") r2 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x14, r5, 0x80485dc1c126afb3, 0x0, 0xffffffff, {0x33}}, 0x32}}, 0x10800) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) syz_mount_image$fuse(0x0, &(0x7f0000000180)='./config/nvmet/ports/1\x00', 0x2800000, 0x0, 0x0, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r6, &(0x7f0000000340)='1', 0x1) ptrace(0x10, r3) setns(0xc9, 0x0) r7 = syz_open_dev$dri(0x0, 0x0, 0x0) r8 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000180)=0x27b, 0x4) dup3(r7, 0xffffffffffffffff, 0x80000) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) write(r7, &(0x7f00000002c0)="44ca616007f18e867e0f65d104e15ab4b178e2bec37931182f6e6b950f143acd60609f532f73c6281ce9f17cb1ad3d3853ee2ffeb6e7ed2eff809408de161bfd71f11a14549a855a4847ff445dbbb79fae4876d5a28a0a48bc", 0xfffffffffffffd36) ptrace$peek(0x3, r3, &(0x7f0000000180)) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r9, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r2, &(0x7f0000000000), 0xfffffffe, 0x16}]) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x7}, 0x2) [ 95.018247][ T4640] Bluetooth: hci0: command tx timeout [ 95.166621][ T5311] loop0: detected capacity change from 0 to 1024 [ 95.264419][ T5311] hfsplus: can't free extent: start 2889, count 1 [ 95.362548][ T24] audit: type=1800 audit(1787238105.965:2): pid=5311 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="attr_allow_any_host" dev="configfs" ino=4268 res=0 errno=0 [ 95.405626][ T5311] [ 95.406783][ T5311] ============================================ [ 95.409380][ T5311] WARNING: possible recursive locking detected [ 95.412068][ T5311] syzkaller #0 Not tainted [ 95.414067][ T5311] -------------------------------------------- [ 95.417094][ T5311] syz.0.0/5311 is trying to acquire lock: [ 95.420106][ T5311] ffff8880434e8740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.424901][ T5311] [ 95.424901][ T5311] but task is already holding lock: [ 95.428107][ T5311] ffff888051282040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.432905][ T5311] [ 95.432905][ T5311] other info that might help us debug this: [ 95.436308][ T5311] Possible unsafe locking scenario: [ 95.436308][ T5311] [ 95.439212][ T5311] CPU0 [ 95.440652][ T5311] ---- [ 95.442148][ T5311] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.444778][ T5311] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.447357][ T5311] [ 95.447357][ T5311] *** DEADLOCK *** [ 95.447357][ T5311] [ 95.450798][ T5311] May be due to missing lock nesting notation [ 95.450798][ T5311] [ 95.454300][ T5311] locks held by syz.0.0/5311: 3, last CPU#0: [ 95.456831][ T5311] #0: ffff8880512821d8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 95.461093][ T5311] #1: ffff888051282040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.465911][ T5311] #2: ffff8880345a00a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 95.470090][ T5311] [ 95.470090][ T5311] stack backtrace: [ 95.472531][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.472549][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.472556][ T5311] Call Trace: [ 95.472565][ T5311] [ 95.472572][ T5311] dump_stack_lvl+0xe8/0x150 [ 95.472594][ T5311] print_deadlock_bug+0x279/0x290 [ 95.472608][ T5311] __lock_acquire+0x24df/0x2cf0 [ 95.472626][ T5311] ? __pfx_hlock_conflict+0x10/0x10 [ 95.472638][ T5311] ? check_path+0x21/0x40 [ 95.472647][ T5311] ? check_noncircular+0xda/0x150 [ 95.472659][ T5311] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.472673][ T5311] lock_acquire+0x106/0x350 [ 95.472688][ T5311] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.472701][ T5311] __mutex_lock+0x19d/0x1550 [ 95.472765][ T5311] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.472780][ T5311] ? __bfs+0x153/0x290 [ 95.472793][ T5311] ? __pfx_hlock_conflict+0x10/0x10 [ 95.472804][ T5311] ? check_path+0x21/0x40 [ 95.472819][ T5311] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.472833][ T5311] ? __pfx___mutex_lock+0x10/0x10 [ 95.472854][ T5311] ? stack_depot_save_flags+0x404/0x7f0 [ 95.472913][ T5311] hfsplus_file_extend+0x21c/0x1df0 [ 95.472930][ T5311] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.472943][ T5311] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.472954][ T5311] ? rcu_is_watching+0x16/0xb0 [ 95.472965][ T5311] ? trace_contention_end+0x3d/0x140 [ 95.472976][ T5311] ? __asan_memset+0x22/0x50 [ 95.472988][ T5311] ? hfsplus_brec_find+0x19a/0x510 [ 95.473000][ T5311] hfsplus_bmap_reserve+0x170/0x590 [ 95.473018][ T5311] __hfsplus_ext_write_extent+0x295/0x690 [ 95.473033][ T5311] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 95.473047][ T5311] ? hfsplus_find_init+0x179/0x2e0 [ 95.473056][ T5311] hfsplus_file_extend+0x502/0x1df0 [ 95.473072][ T5311] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.473086][ T5311] ? clean_bdev_aliases+0x62e/0x750 [ 95.473102][ T5311] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 95.473116][ T5311] hfsplus_get_block+0x41f/0x1610 [ 95.473131][ T5311] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.473144][ T5311] ? do_raw_spin_unlock+0x4d/0x200 [ 95.473157][ T5311] ? _raw_spin_unlock+0x28/0x50 [ 95.473170][ T5311] ? create_empty_buffers+0x460/0x520 [ 95.473184][ T5311] __block_write_begin_int+0x6c2/0x1900 [ 95.473202][ T5311] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.473215][ T5311] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.473231][ T5311] cont_write_begin+0x71b/0xac0 [ 95.473244][ T5311] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.473261][ T5311] ? __pfx_cont_write_begin+0x10/0x10 [ 95.473273][ T5311] ? rcu_is_watching+0x16/0xb0 [ 95.473284][ T5311] hfsplus_write_begin+0x126/0x1e0 [ 95.473295][ T5311] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.473310][ T5311] generic_perform_write+0x2d5/0x8f0 [ 95.473326][ T5311] ? __pfx_generic_perform_write+0x10/0x10 [ 95.473337][ T5311] ? file_update_time_flags+0x3ab/0x440 [ 95.473349][ T5311] ? __generic_file_write_iter+0xf9/0x230 [ 95.473360][ T5311] ? generic_file_write_iter+0x9a/0x330 [ 95.473372][ T5311] generic_file_write_iter+0xae/0x330 [ 95.473386][ T5311] aio_write+0x5d0/0x870 [ 95.473400][ T5311] ? __pfx_aio_write+0x10/0x10 [ 95.473413][ T5311] ? __might_fault+0xaf/0x130 [ 95.473427][ T5311] io_submit_one+0x798/0x13d0 [ 95.473439][ T5311] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.473454][ T5311] ? irqentry_exit+0x218/0x910 [ 95.473477][ T5311] ? __pfx_io_submit_one+0x10/0x10 [ 95.473489][ T5311] ? __might_fault+0xaf/0x130 [ 95.473504][ T5311] ? __might_fault+0xaf/0x130 [ 95.473518][ T5311] __se_sys_io_submit+0x195/0x340 [ 95.473529][ T5311] ? __pfx___se_sys_io_submit+0x10/0x10 [ 95.473543][ T5311] do_syscall_64+0x166/0x520 [ 95.473558][ T5311] ? trace_irq_disable+0x3b/0x140 [ 95.473572][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.473584][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 95.473595][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.473607][ T5311] RIP: 0033:0x7f547f59e0d9 [ 95.473619][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.473629][ T5311] RSP: 002b:00007f5480430fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 95.473645][ T5311] RAX: ffffffffffffffda RBX: 00007f547f825fa0 RCX: 00007f547f59e0d9 [ 95.473654][ T5311] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f54803e7000 [ 95.473662][ T5311] RBP: 00007f547f635024 R08: 0000000000000000 R09: 0000000000000000 [ 95.473669][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.473675][ T5311] R13: 00007f547f826038 R14: 00007f547f825fa0 R15: 00007fffbe3f3498 [ 95.473686][ T5311]