program: syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x2, 0x63f, &(0x7f0000003300)="$eJzs3c1rHOcdB/DvrGRZssFRGttxSyAihrRU1NYLSqte6pZSVAglpIeehS1j4bWTSkpRQmnUN3rtIX9AetCtp0IvhYIgPbe3XHUMFHrJSTltmdlZvVjydjdeeWX38zEz8zzzzDzze347L7trxAb4v7U0ndGdFFmafnOzrO9uzzd3t+cfdMpJzidpJKPtRYqHSfFJcivtKV8tV9bdFY87zkeri29/+vnuZ+3aaD1V2ze67debrXrKVJKRejmo/m4/cX/F/gjLhF3vJA6G7VyS1hE/v3rQ0t2FJ75ugbOgqJ6bB9d8q76yJ6vLPOP1+4D2U7H9zH6mbX0x7AgAAABgwMaPr3phL3vZzKVhhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPqvbv/6f61f/x/VUpplJ0fv9/rNOe5OIQQ+1urLfNdhqnHQgAAAAAAAAAnL5X97KXzVzq1FtFGkleqyqXq/nFvJf1rGQtN7KZ5WxkI2uZTTJ5qKOxzeWNjbXZHvacO3HPuR4DnnjyMQMAAAAAAADAc+g3WTr4/38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLimSkvaimy53yZBqjScaTjJXbbSX/6pSfZTvDDgAAAACeghf2spfNXOrUW0X1mf9q9bl/PO/lYTaymo00s5I71XcB7U/9jd3t+ebu9vyDcjre7/f/01cYVY9pf/dw8pGvVVtM5G5WqzU3cjvvpJk7aVR7lq514jk5rl+XMRXfq/UY2Z16WY78j/XymJG+BtuDXjqcrDJybj8jM3VsZTZe7J6Jo6/OVr9Hmk1j/5ufy6eQ8wv1skgu/vhxOR+KOhOvps7E3KGz72r3TCRf/+uff3av+fD+vbvr02dnSH0432q1OuVHz4n5Q5l4+bnPxGEzVSau7NeX8qP8NNOZyltZy2p+keVsZCVT+WFVWq7P53I+2T1Tt47U3qrmE4+PZKx+Xdp3j/5ieq3a91JW85O8kztZyRvVv7nM5ttZyEIWD73CV3q46hv9XfXXv1EXygH+oftAn7Iyry/Wef0wOXLPnazaDq85yFKKDPreOPq1ulAe47f18mx4NBOzhzLxUvfz5U/VbWW9+fD+2r3ld3s83uv1sryOfn+mnhLl+fKV8sWqakfPjrLtpRPbZqu2y/ttjWNtV/bb/teVOla/hzve01zV9vKJbfNV27VDbSe93wLgzLvwzQtjE/+e+OfExxO/m7g38eb4D85/5/wrYzn3j3PfHZ0Zeb3xSvGXfJxfHXz+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvrz19z+4v9xsrqw9Umi1Wh8+punLFkbSz15//9sgj975PaIBDmewhfF+Nm6djZj7KXzRarUG0uFWl5N2YIVW7UykbkiFId+YgFN3c+PBuzfX3//gW6udR+TCwuLM4sIb8zfvrjZXZtrzIQcJnIqDh/6wIwEAAAAAAAAAAAB69TT+nGDYYwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACebUvTGd1JkdmZGzNlfXd7vllOnfLBlqNJGkmKXybFJ8mttKdMHuquOH6EnWr+0eri259+vvvZQV+jne0bJ+/Xj616ylSSkXo5qP5uP3F/xf4Iy4Rd7yQOhu2/AQAA///xUxF6") creat(&(0x7f0000000040)='./file1\x00', 0x0) (async) r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0) syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) (async) r1 = syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) ioctl$BLKROSET(r1, 0x125d, &(0x7f00000001c0)=0x4) io_uring_register$IORING_REGISTER_CLOCK(r0, 0x1d, &(0x7f0000000000)={0x5}, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r2, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffffe, 0x16}]) [ 94.618996][ T4666] Bluetooth: hci0: command tx timeout [ 94.780530][ T5344] loop0: detected capacity change from 0 to 1024 [ 94.881269][ T5344] hfsplus: can't free extent: start 2889, count 1 [ 94.950112][ T5344] [ 94.951285][ T5344] ============================================ [ 94.953870][ T5344] WARNING: possible recursive locking detected [ 94.956399][ T5344] syzkaller #0 Not tainted [ 94.958209][ T5344] -------------------------------------------- [ 94.960711][ T5344] syz.0.0/5344 is trying to acquire lock: [ 94.962977][ T5344] ffff888053570740 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.969250][ T5344] [ 94.969250][ T5344] but task is already holding lock: [ 94.972225][ T5344] ffff8880536f6040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 94.976671][ T5344] [ 94.976671][ T5344] other info that might help us debug this: [ 94.980168][ T5344] Possible unsafe locking scenario: [ 94.980168][ T5344] [ 94.983372][ T5344] CPU0 [ 94.984936][ T5344] ---- [ 94.986411][ T5344] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.988938][ T5344] lock(&HFSPLUS_I(inode)->extents_lock); [ 94.991473][ T5344] [ 94.991473][ T5344] *** DEADLOCK *** [ 94.991473][ T5344] [ 94.994851][ T5344] May be due to missing lock nesting notation [ 94.994851][ T5344] [ 94.998378][ T5344] locks held by syz.0.0/5344: 3, last CPU#0: [ 95.000782][ T5344] #0: ffff8880536f61d8 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: generic_file_write_iter+0x82/0x330 [ 95.005343][ T5344] #1: ffff8880536f6040 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{4:4}, at: hfsplus_file_extend+0x21c/0x1df0 [ 95.009943][ T5344] #2: ffff8880138fe0a8 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfsplus_find_init+0x179/0x2e0 [ 95.013692][ T5344] [ 95.013692][ T5344] stack backtrace: [ 95.015951][ T5344] CPU: 0 UID: 0 PID: 5344 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.019491][ T5344] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.023849][ T5344] Call Trace: [ 95.025166][ T5344] [ 95.026374][ T5344] dump_stack_lvl+0xe8/0x150 [ 95.028407][ T5344] print_deadlock_bug+0x27a/0x290 [ 95.030585][ T5344] __lock_acquire+0x25db/0x2de0 [ 95.032705][ T5344] ? kvm_clock_get_cycles+0x49/0x60 [ 95.034947][ T5344] ? __bfs+0x153/0x290 [ 95.036705][ T5344] ? __pfx_hlock_conflict+0x10/0x10 [ 95.038779][ T5344] ? check_path+0x21/0x40 [ 95.040439][ T5344] ? check_noncircular+0xdb/0x150 [ 95.042158][ T5344] lock_acquire+0x115/0x350 [ 95.043842][ T5344] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.045965][ T5344] __mutex_lock+0x197/0x15a0 [ 95.048730][ T5344] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.050903][ T5344] ? __bfs+0x153/0x290 [ 95.052638][ T5344] ? __pfx_hlock_conflict+0x10/0x10 [ 95.054866][ T5344] ? check_path+0x21/0x40 [ 95.056753][ T5344] ? hfsplus_file_extend+0x21c/0x1df0 [ 95.058990][ T5344] ? __pfx___mutex_lock+0x10/0x10 [ 95.061166][ T5344] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.064893][ T5344] hfsplus_file_extend+0x21c/0x1df0 [ 95.067109][ T5344] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.069522][ T5344] ? __pfx___mutex_trylock_common+0x10/0x10 [ 95.071891][ T5344] ? rcu_is_watching+0x16/0xb0 [ 95.073822][ T5344] ? trace_contention_end+0x3d/0x140 [ 95.075953][ T5344] ? __asan_memset+0x22/0x50 [ 95.077776][ T5344] ? hfsplus_brec_find+0x19a/0x510 [ 95.079774][ T5344] hfsplus_bmap_reserve+0x170/0x590 [ 95.081895][ T5344] __hfsplus_ext_write_extent+0x295/0x690 [ 95.084197][ T5344] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 95.086342][ T5344] ? hfsplus_find_init+0x179/0x2e0 [ 95.088519][ T5344] hfsplus_file_extend+0x502/0x1df0 [ 95.090606][ T5344] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 95.092732][ T5344] ? clean_bdev_aliases+0x61a/0x740 [ 95.094432][ T5344] ? __pfx_clean_bdev_aliases+0x10/0x10 [ 95.096362][ T5344] hfsplus_get_block+0x41f/0x1610 [ 95.097998][ T5344] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.099868][ T5344] ? do_raw_spin_unlock+0x4d/0x200 [ 95.101810][ T5344] ? _raw_spin_unlock+0x28/0x50 [ 95.103921][ T5344] ? create_empty_buffers+0x41e/0x4d0 [ 95.106191][ T5344] __block_write_begin_int+0x6c1/0x1930 [ 95.108511][ T5344] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.110749][ T5344] ? __pfx___block_write_begin_int+0x10/0x10 [ 95.113238][ T5344] cont_write_begin+0x71b/0xac0 [ 95.115268][ T5344] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.117473][ T5344] ? __pfx_cont_write_begin+0x10/0x10 [ 95.119753][ T5344] ? rcu_is_watching+0x16/0xb0 [ 95.121747][ T5344] hfsplus_write_begin+0x126/0x1e0 [ 95.123999][ T5344] ? __pfx_hfsplus_get_block+0x10/0x10 [ 95.126229][ T5344] generic_perform_write+0x2d5/0x8e0 [ 95.128396][ T5344] ? __pfx_generic_perform_write+0x10/0x10 [ 95.130718][ T5344] ? file_update_time_flags+0x1e0/0x440 [ 95.133050][ T5344] ? __generic_file_write_iter+0xf9/0x230 [ 95.135548][ T5344] ? generic_file_write_iter+0x9a/0x330 [ 95.137757][ T5344] generic_file_write_iter+0xae/0x330 [ 95.140073][ T5344] aio_write+0x5cb/0x870 [ 95.141905][ T5344] ? __pfx_aio_write+0x10/0x10 [ 95.143909][ T5344] io_submit_one+0x798/0x13d0 [ 95.145835][ T5344] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.147988][ T5344] ? irqentry_exit+0x2a0/0x9b0 [ 95.150023][ T5344] ? __pfx_io_submit_one+0x10/0x10 [ 95.152150][ T5344] ? lock_acquire+0x115/0x350 [ 95.154030][ T5344] ? __might_fault+0xaf/0x130 [ 95.155909][ T5344] __se_sys_io_submit+0x195/0x340 [ 95.158004][ T5344] ? __pfx___se_sys_io_submit+0x10/0x10 [ 95.160234][ T5344] do_syscall_64+0x166/0x520 [ 95.162009][ T5344] ? trace_irq_disable+0x3b/0x140 [ 95.164031][ T5344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.166422][ T5344] ? clear_bhb_loop+0x70/0xc0 [ 95.168305][ T5344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.170751][ T5344] RIP: 0033:0x7feb5db9f559 [ 95.172661][ T5344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.180519][ T5344] RSP: 002b:00007feb5e9d5fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 95.184079][ T5344] RAX: ffffffffffffffda RBX: 00007feb5de25fa0 RCX: 00007feb5db9f559 [ 95.187266][ T5344] RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007feb5e98c000 [ 95.190591][ T5344] RBP: 00007feb5dc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 95.193738][ T5344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.196909][ T5344] R13: 00007feb5de26038 R14: 00007feb5de25fa0 R15: 00007ffe26059918 [ 95.200252][ T5344] [ 95.225654][ T5344] Trying to write to read-only block-device loop0