program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000640)='./file0\x00', 0x3010808, &(0x7f0000000940)=ANY=[], 0x2, 0x608, &(0x7f0000000b00)="$eJzs3U1vXFcdB+DfHb/FqUjdNmkBgbCSBagRicfTpl4gERBCXlSoEptuurASJ7EycSvbRW6FwOF1yzdoEXLWrFhULCLBmo+AJRZdINhbbILunTvxJJ6O7SbxjNvnkc6cc+bce865/9x7ru+1Igf40lp8OxP3U2Tx4pubZX1nu9Xe2W7d6ZaTTCVpJOOdLMVqUkwkV9NJ+Vr5Zd1d8VnjvPPRGwufNu/d7dTGtzv9Vds3Bu13OFt1ymySsTrv639H7+/aoP4OYaqnXAbsQjdwMGwP9tk6yu5PeN0Co6Do3Df3mUlOJznVvY/Vq0PjeGf39B1plQMAAIAT6vnd7GYzZ4Y9DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhJ6r//X9Sp0S3Ppuj+/f/J+rvU5RPt/rAnAAAAAAAAAABPwbd2s5vNnOnWHxTV7/zPV5Wz1edzeT/rWc5aLmUzS9nIRtbSTDLT09Hk5tLGxlpz8J6f/DJrme+75/zxHC8AAAAAAAAAfEH9Kot7v/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBRUCRjnaxKZ7vlmTTGk5xKMllut5X8tVs+ye4PewIAAABwDJ7fzW42c6Zbf1BUz/wvV8/9p/J+VrORlWykneVcr94FdJ76GzvbrfbOdutOmfb3+4P/HmkaVY/pvHvoP/JctcW5qv1Pk8lifpyf5mJm81bWspKfZSkbWc5sflSVllJkpn57MdOdZ//5Xn2k9tZBc/1qNZPp3MhKNbdLuZZ30871NKpjqLYZPOLdMjrF92uHjNH1Oi+P6A91fvy2+nw3U0Vk4mFE5urYl9F4YXAkjniePD5SM42H76DOPoOYn67zMta/G1rM+3k8EvM9Z9/LgyORnP/XN/9yq716+9aN9Yujc0if0+ORaPVE4pUvVSQm62h0VtHualk6eLU8X+17Jiv5Sd7N9Szn9Szk9czntbyWuSzkSk9cz+3856Br7WaSo1xrF75TF6aT/L7OR0MZ1xd64tq70s1Ubb3f7EXpxae/Io1/vS6UY/y6zkfD45Fo9kTipcGR+OOD8nO9vXp77dbSe4cc79t1Xl62vx2ptbk8X14s/7Gq2qNnR9n2Ut+2ZtV29mFbY1/buX9+pW476EqdrH+Ge66eUe99omx7pe8oraptrKet3085AIy806+enpz+9/Q/pj+e/s30rek3T/1wamHqG5OZ+Pv4J2N/btxrfK94NR/nF3vP/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOe3/sGHt5fa7eU1BYUTWxivz+ZRmc9oF8poHbzxkBcm4Jm7vHHnvcvrH3z43ZU7SzeXby6vtlrNK/MLVxbmr1y+sdJenut8DnuawDOwd9Mf9kwAAAAAAAAAAACAwzqO/3Iw7GMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATrbFtzNxP0Wac5fmyvrOdqtdpm55b8vxJI0kxc+T4m/J1XRSZnq6Kz5rnHc+emPh0+a9u3t9jXe3bwzab+pQR7FVp8wmGavzJ/BIf9eeuL/i4RGWAbvQDRwM2/8DAAD///ptDTM=") r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000000070108000000000000000000000073797a31000000000000000200"], 0x20}}, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)={0x28, 0x2, 0x7, 0x101, 0x0, 0x0, {0x5}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xe0}]}]}, 0x28}}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0xb, 0xb64c, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000002f010000100001800a000200626f6e643000000014000580"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe6, 0x0) setxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140), &(0x7f0000000000)=ANY=[@ANYBLOB="998e069f4e40ea20226836d5b9067a0b03004597c14c000000"], 0x9, 0x0) syz_mount_image$msdos(&(0x7f0000000200), &(0x7f0000000000)='./file2\x00', 0x1000000, &(0x7f00000000c0)=ANY=[@ANYBLOB='nodots,dmask=00000000000000000000003,usefree,nodots,flush,dots,dots,gid=', @ANYRESHEX=0x0, @ANYBLOB], 0x1, 0x214, &(0x7f0000000840)="$eJzs3D1rW1cYB/AjWa6tlhZPhXbpoV3a5bb10qVDS3GhVNCSRCEv0zWWEyFFAl8NksmgOVM+RwhkCWQL+QL+DFmymYDx5Ck3OJKs2NixE0dy4vx+ix6e/z1X5+jARVy9bP5+91ZjNUtW004ozRdC8Y/QDzuFsBCKYaQffnpwZfvOxavX/v2zUlm6MDvsx/jVd4+v377//ZPOF5cf7nYKIYStxWcbX298s/ni0s16FutZbLU7MY3L7XYnXW7W4ko9ayQx/t+spVkt1ltZbW1fvtpsj5861LIspq1ebNR6sdOOnbVeTG+k9VZMkiTOB06lem8nz8NWnuf5XD/kef62JyhMZl5Myyn3n4/c3kU97l5Nn/e71W518DjI//6nsvRLfGVhPGq7263O7OW/DvK4P58Nnw/zxUPzz8KPPwzy3eyv/yoH8nJYmfzyAQAAAADgXErinkPv7yfJUfmgeu3zgQP370vh29K4MzP5pQAAAABHyHrrjbS5Mrs2KJq1Myvmwv7Ob4+GUzxu+M9Pjz9mQsWXwyK843nKIYSjjymGM9+U6RSj75EPO6PfF5xseOl9TaP8gbwao2I+HBaVw3pjbjqbAgAAnC/jN/0nHlKc6IQAAAAAAAAAAAAAAAAAAADgEzSNPzM76zUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALzJywAAAP//ixdW4w==") r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x842, 0x1fa) write$P9_RCREATE(r5, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x1, 0x4}, 0x3ff}}, 0x18) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r5, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) sync_file_range(r5, 0x88c, 0xab10, 0x6) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x3c, r6, 0x20, 0x70bd27, 0xffff, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x8}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x2}, @NL80211_ATTR_NOACK_MAP={0x6}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008800}, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), &(0x7f00000001c0)=@md5={0x1, "7474919ea04e04917c980c53da46c007"}, 0x1001, 0x0) r8 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r8, &(0x7f0000001740)={0x0, 0xfd77, 0x0}, 0x0) setsockopt$sock_attach_bpf(r8, 0x110, 0x2, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000500)={0x0, {0x2, 0x4e23, @multicast1}, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8, 0x0, 0x0, 0x0, 0xc29, &(0x7f00000004c0)='syz_tun\x00', 0x5, 0x101, 0xf32e}) recvfrom(r0, &(0x7f0000000240)=""/128, 0x80, 0x40010002, &(0x7f00000002c0)=@generic={0xf, "70021c969352c6f7fe882af5f73ac9ceb1d6588bf7fa64df0b9d3607beade9dac35d6c611bfc8dbf93fd67a77eaab511c93aac1d1dd7ed57f3f29dbb4955f8312388d75dd3b17db970aff443c4f8d6e865d0c55d992229fb0c746d1f739d52f9aa0a6d04988b1f67437f4340622be098ffac32eba8f33f1e529949e89c52"}, 0x80) [ 124.500924][ T4649] Bluetooth: hci0: command tx timeout [ 124.628534][ T5326] loop0: detected capacity change from 0 to 1024 [ 124.832891][ T5326] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 124.891701][ T5327] netlink: 16 bytes leftover after parsing attributes in process `syz.0.0'. [ 125.334025][ T5325] [ 125.335199][ T5325] ============================================ [ 125.337854][ T5325] WARNING: possible recursive locking detected [ 125.340565][ T5325] syzkaller #0 Not tainted [ 125.342476][ T5325] -------------------------------------------- [ 125.345033][ T5325] syz.0.0/5325 is trying to acquire lock: [ 125.347437][ T5325] ffff88805239f300 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_get_block+0x391/0x1610 [ 125.352067][ T5325] [ 125.352067][ T5325] but task is already holding lock: [ 125.355257][ T5325] ffff88805239da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 125.359799][ T5325] [ 125.359799][ T5325] other info that might help us debug this: [ 125.362954][ T5325] Possible unsafe locking scenario: [ 125.362954][ T5325] [ 125.365824][ T5325] CPU0 [ 125.367130][ T5325] ---- [ 125.368417][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 125.370717][ T5325] lock(&HFSPLUS_I(inode)->extents_lock); [ 125.373176][ T5325] [ 125.373176][ T5325] *** DEADLOCK *** [ 125.373176][ T5325] [ 125.376489][ T5325] May be due to missing lock nesting notation [ 125.376489][ T5325] [ 125.380340][ T5325] locks held by syz.0.0/5325: 3, last CPU#0: [ 125.383437][ T5325] #0: ffff88805239db98 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: hfsplus_file_release+0xe2/0x3e0 [ 125.388521][ T5325] #1: ffff88805239da00 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_truncate+0x2d0/0xd20 [ 125.393474][ T5325] #2: ffff8880523980f0 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_block_free+0xc7/0x630 [ 125.397847][ T5325] [ 125.397847][ T5325] stack backtrace: [ 125.400457][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 125.404440][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.408826][ T5325] Call Trace: [ 125.410402][ T5325] [ 125.411805][ T5325] dump_stack_lvl+0xe8/0x150 [ 125.414093][ T5325] print_deadlock_bug+0x27a/0x290 [ 125.416508][ T5325] __lock_acquire+0x25db/0x2de0 [ 125.418783][ T5325] ? is_bpf_text_address+0x292/0x2b0 [ 125.421326][ T5325] ? is_bpf_text_address+0x26/0x2b0 [ 125.423870][ T5325] ? kernel_text_address+0xa5/0xe0 [ 125.426337][ T5325] lock_acquire+0x115/0x350 [ 125.428496][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 125.430875][ T5325] __mutex_lock+0x19d/0x1550 [ 125.433039][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 125.435379][ T5325] ? check_path+0x21/0x40 [ 125.437381][ T5325] ? check_noncircular+0xdb/0x150 [ 125.439693][ T5325] ? add_lock_to_list+0xc7/0x100 [ 125.441938][ T5325] ? hfsplus_get_block+0x391/0x1610 [ 125.444338][ T5325] ? __pfx___mutex_lock+0x10/0x10 [ 125.446637][ T5325] hfsplus_get_block+0x391/0x1610 [ 125.448959][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 125.451407][ T5325] ? block_read_full_folio+0x65a/0x810 [ 125.453388][ T5325] block_read_full_folio+0x29f/0x810 [ 125.455520][ T5325] ? __pfx_hfsplus_get_block+0x10/0x10 [ 125.457710][ T5325] filemap_read_folio+0x12c/0x3a0 [ 125.459795][ T5325] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 125.462213][ T5325] ? __pfx_filemap_read_folio+0x10/0x10 [ 125.464708][ T5325] ? filemap_add_folio+0x336/0x4e0 [ 125.466970][ T5325] do_read_cache_folio+0x354/0x590 [ 125.469323][ T5325] ? __pfx_hfsplus_read_folio+0x10/0x10 [ 125.471771][ T5325] read_cache_page+0x5d/0x170 [ 125.473784][ T5325] hfsplus_block_free+0x134/0x630 [ 125.475740][ T5325] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 125.478041][ T5325] hfsplus_free_extents+0x121/0xa50 [ 125.480190][ T5325] hfsplus_file_truncate+0x7ef/0xd20 [ 125.482303][ T5325] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 125.484796][ T5325] ? down_write+0x16b/0x200 [ 125.486700][ T5325] ? __pfx_down_write+0x10/0x10 [ 125.488737][ T5325] hfsplus_file_release+0x303/0x3e0 [ 125.491088][ T5325] ? __pfx_hfsplus_file_release+0x10/0x10 [ 125.493297][ T5325] __fput+0x418/0xa50 [ 125.494998][ T5325] task_work_run+0x1d9/0x270 [ 125.497120][ T5325] ? __pfx_task_work_run+0x10/0x10 [ 125.499396][ T5325] exit_to_user_mode_loop+0x204/0x770 [ 125.501668][ T5325] ? rcu_is_watching+0x16/0xb0 [ 125.503734][ T5325] do_syscall_64+0x328/0x520 [ 125.505687][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.508271][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 125.510220][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.512589][ T5325] RIP: 0033:0x7f3ae979e159 [ 125.514434][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.522696][ T5325] RSP: 002b:00007ffca9c534b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 125.526243][ T5325] RAX: 0000000000000000 RBX: 00007f3ae9a27da0 RCX: 00007f3ae979e159 [ 125.529695][ T5325] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 125.533057][ T5325] RBP: 00007f3ae9a27da0 R08: 0000000000000006 R09: 0000000000000000 [ 125.536326][ T5325] R10: 00007f3ae9a27cb0 R11: 0000000000000246 R12: 000000000001e8e7 [ 125.539672][ T5325] R13: 00007f3ae9a2609c R14: 000000000001e77d R15: 00007f3ae9a26090 [ 125.542997][ T5325] [ 125.552016][ T5325] hfsplus: unable to mark blocks free: error -5 [ 125.552028][ T5325] hfsplus: can't free extent: start 134, count 1