program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x5a}, 0x8) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x45, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000000)=@new_dev={0x1, 0xaa9, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x1}}}, &(0x7f00000001c0)) syz_open_dev$video4linux(&(0x7f0000000380), 0x2, 0x400080) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[], 0x44}}, 0x0) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) ioctl$KVM_CREATE_VM(r3, 0x40086806, 0x21) read$FUSE(r3, &(0x7f0000002080)={0x2020}, 0x2020) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r5 = dup2(r4, r3) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000600)=@security={'security\x00', 0xe, 0x4, 0x4c8, 0xffffffff, 0x2f0, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x3f8, 0x3f8, 0x3f8, 0xffffffff, 0x4, &(0x7f0000000340), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x5, 0x28}}}, {{@uncond, 0x0, 0x1e0, 0x220, 0x0, {}, [@common=@rt={{0x138}, {0x80000001, [0x5, 0xff], 0xd96, 0x2, 0x4, [@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0, @private2, @remote, @empty, @private2={0xfc, 0x2, '\x00', 0x7}, @loopback, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x18}, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @loopback, @private1, @empty, @mcast2, @local], 0x9}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4, 0x20, "a4a87f87941d02d7b98117280839674a16804bed2dd6e06380bde8555303"}}}, {{@ipv6={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffffff, 0xffffffff, 0x0, 0xffffff00], [0xff, 0x0, 0x0, 0xffffffff], 'macvlan0\x00', 'veth0_macvtap\x00', {}, {}, 0x0, 0xfe, 0x7, 0x8}, 0x0, 0xd0, 0x108, 0x0, {}, [@common=@icmp6={{0x28}, {0x12, '&!'}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x5, 0x2}, {0x1, 0x3, 0x1}, {0x3}, 0xd561, 0x8}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) ioctl$UBLK_U_CMD_GET_PARAMS(r4, 0x80207509, &(0x7f0000000240)={0x0, 0xffff, 0x70, &(0x7f00000004c0)={0x70}}) r6 = creat(&(0x7f00000002c0)='./file1\x00', 0xa4) io_setup(0x202, &(0x7f0000000200)=0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r9, 0x5000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x18, 0x5, 0x0, 0x1, @immediate={{0xe, 0x20}, @val={0x4}}}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x34}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xac}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$pppoe(0x18, 0x1, 0x0) io_submit(r7, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r6, &(0x7f0000000000), 0xfffffffe, 0x16}]) [ 94.597446][ T5283] Bluetooth: hci0: command tx timeout [ 94.680812][ T5318] loop0: detected capacity change from 0 to 1024 [ 94.947855][ T5319] hfsplus: can't free extent: start 2889, count 1 [ 95.262100][ T5325] [ 95.263206][ T5325] ============================================ [ 95.265734][ T5325] WARNING: possible recursive locking detected [ 95.268232][ T5325] syzkaller #0 Not tainted [ 95.270071][ T5325] -------------------------------------------- [ 95.272616][ T5325] syz.0.0/5325 is trying to acquire lock: [ 95.275071][ T5325] ffff8880125e8740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.279534][ T5325] [ 95.279534][ T5325] but task is already holding lock: [ 95.282505][ T5325] ffff88801215da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.286778][ T5325] [ 95.286778][ T5325] other info that might help us debug this: [ 95.290212][ T5325] Possible unsafe locking scenario: [ 95.290212][ T5325] [ 95.293317][ T5325] CPU0 [ 95.294662][ T5325] ---- [ 95.296059][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.298542][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 95.300790][ T5325] [ 95.300790][ T5325] *** DEADLOCK *** [ 95.300790][ T5325] [ 95.304245][ T5325] May be due to missing lock nesting notation [ 95.304245][ T5325] [ 95.307767][ T5325] locks held by syz.0.0/5325: 3, last CPU#0: [ 95.310417][ T5325] #0: ffff88801215db98 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 95.315145][ T5325] #1: ffff88801215da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.319885][ T5325] #2: ffff88803edf20a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 95.324093][ T5325] [ 95.324093][ T5325] stack backtrace: [ 95.326553][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.330285][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.334295][ T5325] Call Trace: [ 95.335753][ T5325] [ 95.337079][ T5325] dump_stack_lvl+0xe8/0x150 [ 95.339033][ T5325] print_deadlock_bug+0x27a/0x290 [ 95.341136][ T5325] __lock_acquire+0x261c/0x2e50 [ 95.343239][ T5325] ? __bfs+0x153/0x290 [ 95.345002][ T5325] ? __pfx_hlock_conflict+0x10/0x10 [ 95.347237][ T5325] ? check_path+0x21/0x40 [ 95.349042][ T5325] ? check_noncircular+0xdb/0x150 [ 95.351249][ T5325] lock_acquire+0x115/0x350 [ 95.353315][ T5325] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.355661][ T5325] __mutex_lock+0x19d/0x1550 [ 95.357734][ T5325] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.360078][ T5325] ? __bfs+0x153/0x290 [ 95.361878][ T5325] ? __pfx_hlock_conflict+0x10/0x10 [ 95.363992][ T5325] ? check_path+0x21/0x40 [ 95.365673][ T5325] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.367852][ T5325] ? __pfx___mutex_lock+0x10/0x10 [ 95.369944][ T5325] hfsplus_file_extend+0x21c/0x1df0 [ 95.372064][ T5325] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.374193][ T5325] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.376401][ T5325] ? rcu_is_watching+0x16/0xb0 [ 95.378350][ T5325] ? trace_contention_end+0x3d/0x140 [ 95.380575][ T5325] ? __asan_memset+0x22/0x50 [ 95.382535][ T5325] ? hfsplus_brec_find+0x19a/0x510 [ 95.384697][ T5325] hfsplus_bmap_reserve+0x170/0x590 [ 95.386881][ T5325] __hfsplus_ext_write_extent+0x295/0x690 [ 95.389270][ T5325] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 95.391579][ T5325] ? hfsplus_find_init+0x179/0x2e0 [ 95.393737][ T5325] hfsplus_file_extend+0x502/0x1df0 [ 95.395887][ T5325] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.398325][ T5325] ? clean_bdev_aliases+0x62e/0x750 [ 95.400463][ T5325] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 95.402881][ T5325] hfsplus_get_block+0x41f/0x1610 [ 95.405104][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.407427][ T5325] ? do_raw_spin_unlock+0x4d/0x200 [ 95.409620][ T5325] ? _raw_spin_unlock+0x28/0x50 [ 95.411601][ T5325] ? create_empty_buffers+0x460/0x520 [ 95.413896][ T5325] __block_write_begin_int+0x6c2/0x1900 [ 95.415969][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.418288][ T5325] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.420445][ T5325] cont_write_begin+0x71b/0xac0 [ 95.422250][ T5325] ? __pfx_cont_write_begin+0x10/0x10 [ 95.424443][ T5325] ? rcu_is_watching+0x16/0xb0 [ 95.426417][ T5325] hfsplus_write_begin+0x126/0x1e0 [ 95.428496][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.430797][ T5325] generic_perform_write+0x2d5/0x8f0 [ 95.432959][ T5325] ? __pfx_generic_perform_write+0x10/0x10 [ 95.435415][ T5325] ? file_update_time_flags+0x1e0/0x440 [ 95.437802][ T5325] ? __generic_file_write_iter+0xf9/0x230 [ 95.440450][ T5325] ? generic_file_write_iter+0x9a/0x330 [ 95.442808][ T5325] generic_file_write_iter+0xae/0x330 [ 95.444990][ T5325] aio_write+0x5d0/0x870 [ 95.446698][ T5325] ? __pfx_aio_write+0x10/0x10 [ 95.448626][ T5325] io_submit_one+0x798/0x13d0 [ 95.450639][ T5325] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.452771][ T5325] ? irqentry_exit+0x218/0x910 [ 95.454856][ T5325] ? __pfx_io_submit_one+0x10/0x10 [ 95.457112][ T5325] ? lock_acquire+0x115/0x350 [ 95.459145][ T5325] ? __might_fault+0xaf/0x130 [ 95.461074][ T5325] __se_sys_io_submit+0x195/0x340 [ 95.463113][ T5325] ? __pfx___se_sys_io_submit+0x10/0x10 [ 95.465489][ T5325] do_syscall_64+0x166/0x520 [ 95.467491][ T5325] ? trace_irq_disable+0x3b/0x140 [ 95.469771][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.472927][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 95.475281][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.477796][ T5325] RIP: 0033:0x7fe79dd9e159 [ 95.479585][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.487899][ T5325] RSP: 002b:00007fe79ec90fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 95.491684][ T5325] RAX: ffffffffffffffda RBX: 00007fe79e026180 RCX: 00007fe79dd9e159 [ 95.495804][ T5325] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007fe79ec92000 [ 95.499313][ T5325] RBP: 00007fe79de35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.502831][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.506396][ T5325] R13: 00007fe79e026218 R14: 00007fe79e026180 R15: 00007ffff3bb65d8 [ 95.509895][ T5325]