program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/md_mod/parameters/new_array\x00', 0x101081, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl(r1, 0x40140921, &(0x7f0000000440)) [ 86.115372][ T5288] Bluetooth: hci0: command tx timeout [ 86.254618][ T5326] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 86.272359][ T5327] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 86.272486][ T5327] block device autoloading is deprecated and will be removed. [ 86.359079][ T5326] md/raid10:md0: not clean -- starting background reconstruction [ 86.359097][ T5326] md/raid10:md0: active with 1 out of 2 devices [ 86.361529][ T5326] md0: detected capacity change from 0 to 2048 [ 86.391226][ T5327] [ 86.392380][ T5327] ====================================================== [ 86.395537][ T5327] WARNING: possible circular locking dependency detected [ 86.398537][ T5327] syzkaller #0 Not tainted [ 86.400501][ T5327] ------------------------------------------------------ [ 86.403611][ T5327] syz.0.0/5327 is trying to acquire lock: [ 86.406119][ T5327] ffffffff905568e0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 86.410418][ T5327] [ 86.410418][ T5327] but task is already holding lock: [ 86.413789][ T5327] ffff88801d32c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 86.418403][ T5327] [ 86.418403][ T5327] which lock already depends on the new lock. [ 86.418403][ T5327] [ 86.422983][ T5327] [ 86.422983][ T5327] the existing dependency chain (in reverse order) is: [ 86.427002][ T5327] [ 86.427002][ T5327] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 86.430684][ T5327] __mutex_lock+0x19d/0x1550 [ 86.433014][ T5327] md_start_sync+0x179/0x1010 [ 86.435402][ T5327] process_scheduled_works+0xc3d/0x1630 [ 86.438147][ T5327] worker_thread+0xa47/0xfb0 [ 86.440388][ T5327] kthread+0x38b/0x480 [ 86.442326][ T5327] ret_from_fork+0x514/0xb70 [ 86.444422][ T5327] ret_from_fork_asm+0x1a/0x30 [ 86.446607][ T5327] [ 86.446607][ T5327] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 86.450368][ T5327] process_scheduled_works+0xc03/0x1630 [ 86.453017][ T5327] worker_thread+0xa47/0xfb0 [ 86.455042][ T5327] kthread+0x38b/0x480 [ 86.456749][ T5327] ret_from_fork+0x514/0xb70 [ 86.458548][ T5327] ret_from_fork_asm+0x1a/0x30 [ 86.460577][ T5327] [ 86.460577][ T5327] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 86.463613][ T5327] touch_wq_lockdep_map+0xcb/0x180 [ 86.465991][ T5327] __flush_workqueue+0x148/0x1470 [ 86.468559][ T5327] md_alloc+0x32/0xf20 [ 86.470677][ T5327] md_alloc_and_put+0x1a/0x1f0 [ 86.473080][ T5327] blk_request_module+0x27d/0x2a0 [ 86.475594][ T5327] blkdev_get_no_open+0x3f/0xe0 [ 86.477843][ T5327] blkdev_open+0x1d7/0x600 [ 86.480152][ T5327] do_dentry_open+0x816/0x1380 [ 86.482628][ T5327] vfs_open+0x3b/0x340 [ 86.484729][ T5327] path_openat+0x1443/0x1d60 [ 86.487131][ T5327] do_file_open+0x23e/0x4a0 [ 86.489432][ T5327] do_sys_openat2+0x115/0x200 [ 86.491738][ T5327] __x64_sys_openat+0x138/0x170 [ 86.493955][ T5327] do_syscall_64+0x166/0x520 [ 86.496434][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.499311][ T5327] [ 86.499311][ T5327] -> #0 (major_names_lock){+.+.}-{4:4}: [ 86.502706][ T5327] __lock_acquire+0x164c/0x2de0 [ 86.505072][ T5327] lock_acquire+0x115/0x350 [ 86.507264][ T5327] __mutex_lock+0x19d/0x1550 [ 86.509468][ T5327] blk_request_module+0x35/0x2a0 [ 86.511930][ T5327] blkdev_get_no_open+0x3f/0xe0 [ 86.514321][ T5327] bdev_file_open_by_dev+0xa0/0x240 [ 86.516831][ T5327] md_import_device+0x2e9/0x650 [ 86.519253][ T5327] md_add_new_disk+0x669/0x1850 [ 86.521677][ T5327] md_ioctl+0x200a/0x2610 [ 86.523865][ T5327] blkdev_ioctl+0x5e3/0x740 [ 86.526161][ T5327] __se_sys_ioctl+0xfc/0x170 [ 86.528420][ T5327] do_syscall_64+0x166/0x520 [ 86.530668][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.533432][ T5327] [ 86.533432][ T5327] other info that might help us debug this: [ 86.533432][ T5327] [ 86.537741][ T5327] Chain exists of: [ 86.537741][ T5327] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 86.537741][ T5327] [ 86.544486][ T5327] Possible unsafe locking scenario: [ 86.544486][ T5327] [ 86.547479][ T5327] CPU0 CPU1 [ 86.549557][ T5327] ---- ---- [ 86.551902][ T5327] lock(&mddev->reconfig_mutex); [ 86.554155][ T5327] lock((work_completion)(&mddev->sync_work)); [ 86.558011][ T5327] lock(&mddev->reconfig_mutex); [ 86.561220][ T5327] lock(major_names_lock); [ 86.563224][ T5327] [ 86.563224][ T5327] *** DEADLOCK *** [ 86.563224][ T5327] [ 86.566539][ T5327] locks held by syz.0.0/5327: 1, last CPU#0: [ 86.569018][ T5327] #0: ffff88801d32c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 86.573454][ T5327] [ 86.573454][ T5327] stack backtrace: [ 86.576009][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.579639][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.583763][ T5327] Call Trace: [ 86.585198][ T5327] [ 86.586480][ T5327] dump_stack_lvl+0xe8/0x150 [ 86.588428][ T5327] print_circular_bug+0x2e2/0x300 [ 86.590646][ T5327] check_noncircular+0x12f/0x150 [ 86.592686][ T5327] __lock_acquire+0x164c/0x2de0 [ 86.594744][ T5327] ? post_alloc_hook+0x208/0x250 [ 86.596888][ T5327] ? get_page_from_freelist+0x2209/0x2280 [ 86.599247][ T5327] lock_acquire+0x115/0x350 [ 86.601059][ T5327] ? blk_request_module+0x35/0x2a0 [ 86.603297][ T5327] __mutex_lock+0x19d/0x1550 [ 86.605312][ T5327] ? blk_request_module+0x35/0x2a0 [ 86.607444][ T5327] ? lock_acquire+0x115/0x350 [ 86.609471][ T5327] ? blk_request_module+0x35/0x2a0 [ 86.611529][ T5327] ? __pfx___mutex_lock+0x10/0x10 [ 86.613711][ T5327] ? find_inode_fast+0x5dc/0x740 [ 86.615777][ T5327] ? find_inode_fast+0xd2/0x740 [ 86.617776][ T5327] blk_request_module+0x35/0x2a0 [ 86.619866][ T5327] blkdev_get_no_open+0x3f/0xe0 [ 86.622230][ T5327] bdev_file_open_by_dev+0xa0/0x240 [ 86.624470][ T5327] md_import_device+0x2e9/0x650 [ 86.626766][ T5327] md_add_new_disk+0x669/0x1850 [ 86.629022][ T5327] md_ioctl+0x200a/0x2610 [ 86.631000][ T5327] ? tomoyo_path_number_perm+0x219/0x5f0 [ 86.633470][ T5327] ? __pfx_md_ioctl+0x10/0x10 [ 86.635550][ T5327] ? do_vfs_ioctl+0x116f/0x1530 [ 86.637732][ T5327] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 86.640377][ T5327] ? hook_file_ioctl+0x1f2/0x600 [ 86.642861][ T5327] ? __pfx_md_ioctl+0x10/0x10 [ 86.644976][ T5327] blkdev_ioctl+0x5e3/0x740 [ 86.647002][ T5327] ? __pfx_blkdev_ioctl+0x10/0x10 [ 86.649225][ T5327] ? __fget_files+0x2a/0x420 [ 86.651325][ T5327] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.653505][ T5327] ? __pfx_blkdev_ioctl+0x10/0x10 [ 86.655648][ T5327] __se_sys_ioctl+0xfc/0x170 [ 86.657577][ T5327] do_syscall_64+0x166/0x520 [ 86.659319][ T5327] ? trace_irq_disable+0x3b/0x140 [ 86.662263][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.664854][ T5327] ? clear_bhb_loop+0x70/0xc0 [ 86.666887][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.669401][ T5327] RIP: 0033:0x7f496e39e1d9 [ 86.671363][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.679247][ T5327] RSP: 002b:00007f496f2dafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.682826][ T5327] RAX: ffffffffffffffda RBX: 00007f496e626090 RCX: 00007f496e39e1d9 [ 86.686158][ T5327] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 86.689173][ T5327] RBP: 00007f496e435888 R08: 0000000000000000 R09: 0000000000000000 [ 86.692440][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.695765][ T5327] R13: 00007f496e626128 R14: 00007f496e626090 R15: 00007ffd6b10f698 [ 86.698888][ T5327] [ 86.702934][ T5330] md: resync of RAID array md0 [ 86.720917][ T5330] md: md0: resync done. [ 86.786186][ T5327] md: could not open device unknown-block(0,0). [ 86.786241][ T5327] md: md_import_device returned -6