[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Warning: Permanently added '10.128.0.104' (ECDSA) to the list of known hosts. Debian GNU/Linux 9 syzkaller ttyS0 executing program syzkaller login: [ 75.765118][ T37] audit: type=1400 audit(1628735547.950:8): avc: denied { execmem } for pid=8436 comm="syz-executor956" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 75.878469][ T8438] md: md1 stopped. [ 75.899464][ T26] [ 75.901798][ T26] ====================================================== [ 75.908803][ T26] WARNING: possible circular locking dependency detected [ 75.915814][ T26] 5.14.0-rc5-syzkaller #0 Not tainted [ 75.921261][ T26] ------------------------------------------------------ [ 75.928269][ T26] kworker/1:1/26 is trying to acquire lock: [ 75.934150][ T26] ffff8880291c8118 (&disk->open_mutex){+.+.}-{3:3}, at: del_gendisk+0x8b/0x770 [ 75.943148][ T26] [ 75.943148][ T26] but task is already holding lock: [ 75.950505][ T26] ffffc90001027db0 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1630 [ 75.961649][ T26] [ 75.961649][ T26] which lock already depends on the new lock. [ 75.961649][ T26] [ 75.972032][ T26] [ 75.972032][ T26] the existing dependency chain (in reverse order) is: [ 75.981024][ T26] [ 75.981024][ T26] -> #4 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}: [ 75.990387][ T26] process_one_work+0x8fc/0x1630 [ 75.995837][ T26] worker_thread+0x658/0x11f0 [ 76.001025][ T26] kthread+0x3e5/0x4d0 [ 76.005602][ T26] ret_from_fork+0x1f/0x30 [ 76.010528][ T26] [ 76.010528][ T26] -> #3 ((wq_completion)md_misc){+.+.}-{0:0}: [ 76.018761][ T26] flush_workqueue+0x110/0x1600 [ 76.024123][ T26] md_alloc+0x29/0x1190 [ 76.028786][ T26] md_probe+0x69/0x70 [ 76.033277][ T26] blk_request_module+0x111/0x1d0 [ 76.038811][ T26] blkdev_get_no_open+0x1d5/0x250 [ 76.044344][ T26] blkdev_get_by_dev.part.0+0x25/0xdd0 [ 76.050313][ T26] blkdev_open+0x295/0x300 [ 76.055241][ T26] do_dentry_open+0x4c8/0x11d0 [ 76.060511][ T26] path_openat+0x1c23/0x27f0 [ 76.065613][ T26] do_filp_open+0x1aa/0x400 [ 76.070621][ T26] do_sys_openat2+0x16d/0x420 [ 76.075805][ T26] __x64_sys_openat+0x13f/0x1f0 [ 76.081162][ T26] do_syscall_64+0x35/0xb0 [ 76.086106][ T26] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 76.092510][ T26] [ 76.092510][ T26] -> #2 (major_names_lock){+.+.}-{3:3}: [ 76.100224][ T26] __mutex_lock+0x12a/0x10a0 [ 76.105327][ T26] __register_blkdev+0x2b/0x3e0 [ 76.110688][ T26] register_mtd_blktrans+0x85/0x3c0 [ 76.116395][ T26] do_one_initcall+0x103/0x650 [ 76.121671][ T26] kernel_init_freeable+0x6b8/0x741 [ 76.127383][ T26] kernel_init+0x1a/0x1d0 [ 76.132226][ T26] ret_from_fork+0x1f/0x30 [ 76.137151][ T26] [ 76.137151][ T26] -> #1 (mtd_table_mutex){+.+.}-{3:3}: [ 76.144779][ T26] __mutex_lock+0x12a/0x10a0 [ 76.149889][ T26] blktrans_open+0x69/0x600 [ 76.154908][ T26] blkdev_get_whole+0xa1/0x420 [ 76.160185][ T26] blkdev_get_by_dev.part.0+0x30c/0xdd0 [ 76.166244][ T26] blkdev_open+0x295/0x300 [ 76.171173][ T26] do_dentry_open+0x4c8/0x11d0 [ 76.176442][ T26] path_openat+0x1c23/0x27f0 [ 76.181546][ T26] do_filp_open+0x1aa/0x400 [ 76.186553][ T26] do_sys_openat2+0x16d/0x420 [ 76.191737][ T26] __x64_sys_open+0x119/0x1c0 [ 76.196921][ T26] do_syscall_64+0x35/0xb0 [ 76.201853][ T26] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 76.208260][ T26] [ 76.208260][ T26] -> #0 (&disk->open_mutex){+.+.}-{3:3}: [ 76.216062][ T26] __lock_acquire+0x2a07/0x54a0 [ 76.221422][ T26] lock_acquire+0x1ab/0x510 [ 76.226438][ T26] __mutex_lock+0x12a/0x10a0 [ 76.231546][ T26] del_gendisk+0x8b/0x770 [ 76.236388][ T26] md_free+0xc7/0x1c0 [ 76.240882][ T26] kobject_put+0x1c8/0x540 [ 76.245811][ T26] process_one_work+0x98d/0x1630 [ 76.251263][ T26] worker_thread+0x658/0x11f0 [ 76.256452][ T26] kthread+0x3e5/0x4d0 [ 76.261032][ T26] ret_from_fork+0x1f/0x30 [ 76.265961][ T26] [ 76.265961][ T26] other info that might help us debug this: [ 76.265961][ T26] [ 76.276170][ T26] Chain exists of: [ 76.276170][ T26] &disk->open_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->del_work) [ 76.276170][ T26] [ 76.291707][ T26] Possible unsafe locking scenario: [ 76.291707][ T26] [ 76.299137][ T26] CPU0 CPU1 [ 76.304482][ T26] ---- ---- [ 76.309826][ T26] lock((work_completion)(&mddev->del_work)); [ 76.315964][ T26] lock((wq_completion)md_misc); [ 76.323491][ T26] lock((work_completion)(&mddev->del_work)); [ 76.332146][ T26] lock(&disk->open_mutex); [ 76.336721][ T26] [ 76.336721][ T26] *** DEADLOCK *** [ 76.336721][ T26] [ 76.344844][ T26] 2 locks held by kworker/1:1/26: [ 76.349850][ T26] #0: ffff888141dbb538 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_one_work+0x871/0x1630 [ 76.360281][ T26] #1: ffffc90001027db0 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1630 [ 76.371843][ T26] [ 76.371843][ T26] stack backtrace: [ 76.377713][ T26] CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 5.14.0-rc5-syzkaller #0 [ 76.385939][ T26] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.395979][ T26] Workqueue: md_misc mddev_delayed_delete [ 76.401693][ T26] Call Trace: [ 76.404962][ T26] dump_stack_lvl+0xcd/0x134 [ 76.409542][ T26] check_noncircular+0x25f/0x2e0 [ 76.414467][ T26] ? print_circular_bug+0x1e0/0x1e0 [ 76.419655][ T26] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 76.425885][ T26] ? _find_first_zero_bit+0x94/0xb0 [ 76.431074][ T26] ? lockdep_lock+0xc6/0x200 [ 76.435658][ T26] ? call_rcu_zapped+0xb0/0xb0 [ 76.440414][ T26] __lock_acquire+0x2a07/0x54a0 [ 76.445257][ T26] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 76.451232][ T26] lock_acquire+0x1ab/0x510 [ 76.455726][ T26] ? del_gendisk+0x8b/0x770 [ 76.460220][ T26] ? lock_release+0x720/0x720 [ 76.464884][ T26] ? find_held_lock+0x2d/0x110 [ 76.469638][ T26] __mutex_lock+0x12a/0x10a0 [ 76.474222][ T26] ? del_gendisk+0x8b/0x770 [ 76.478715][ T26] ? __mutex_unlock_slowpath+0xe2/0x610 [ 76.484255][ T26] ? del_gendisk+0x8b/0x770 [ 76.488748][ T26] ? __mutex_unlock_slowpath+0xe2/0x610 [ 76.494291][ T26] ? mutex_lock_io_nested+0xf00/0xf00 [ 76.499660][ T26] ? wait_for_completion_io+0x280/0x280 [ 76.505200][ T26] ? disk_block_events+0xc0/0x130 [ 76.510219][ T26] del_gendisk+0x8b/0x770 [ 76.514539][ T26] md_free+0xc7/0x1c0 [ 76.518512][ T26] kobject_put+0x1c8/0x540 [ 76.522917][ T26] process_one_work+0x98d/0x1630 [ 76.527850][ T26] ? pwq_dec_nr_in_flight+0x320/0x320 [ 76.533220][ T26] ? rwlock_bug.part.0+0x90/0x90 [ 76.538149][ T26] ? _raw_spin_lock_irq+0x41/0x50 [ 76.543184][ T26] worker_thread+0x658/0x11f0 [ 76.547859][ T26] ? process_one_work+0x1630/0x163