program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x8502, 0x8afa6298a3a21d70) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") r2 = syz_open_dev$video(&(0x7f00000001c0), 0x2, 0x202000) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000280)={0x9f0000, 0x8, 0x80000001, r1, 0x0, &(0x7f0000000240)={0x980001, 0x1, '\x00', @ptr=0x4}}) ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x928, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) (async) write(r0, &(0x7f0000000200)='md0', 0x3) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x8502, 0x8afa6298a3a21d70) (async) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") (async) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") (async) syz_open_dev$video(&(0x7f00000001c0), 0x2, 0x202000) (async) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000280)={0x9f0000, 0x8, 0x80000001, r1, 0x0, &(0x7f0000000240)={0x980001, 0x1, '\x00', @ptr=0x4}}) (async) ioctl(r1, 0x400c0930, 0x0) (async) ioctl(r1, 0x928, 0x0) (async) [ 95.509223][ T4641] Bluetooth: hci0: command tx timeout [ 95.692032][ T5314] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.694401][ T5315] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.694546][ T5315] block device autoloading is deprecated and will be removed. [ 95.784210][ T5314] md/raid10:md0: not clean -- starting background reconstruction [ 95.784226][ T5314] md/raid10:md0: active with 1 out of 2 devices [ 95.803081][ T5314] md0: detected capacity change from 0 to 2048 [ 95.885603][ T5329] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.909436][ T5315] md: could not open device unknown-block(0,0). [ 95.909484][ T5315] md: error, md_import_device() returned -6 [ 95.911157][ T54] [ 95.917914][ T54] ====================================================== [ 95.921139][ T54] WARNING: possible circular locking dependency detected [ 95.924242][ T54] syzkaller #0 Not tainted [ 95.926176][ T54] ------------------------------------------------------ [ 95.928755][ T54] kworker/0:2/54 is trying to acquire lock: [ 95.930929][ T54] ffff888012f6a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_start_sync+0x179/0x1010 [ 95.935153][ T54] [ 95.935153][ T54] but task is already holding lock: [ 95.938568][ T54] ffffc90000af7c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 95.943545][ T54] [ 95.943545][ T54] which lock already depends on the new lock. [ 95.943545][ T54] [ 95.948151][ T54] [ 95.948151][ T54] the existing dependency chain (in reverse order) is: [ 95.951823][ T54] [ 95.951823][ T54] -> #3 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 95.955963][ T54] process_scheduled_works+0xc03/0x1630 [ 95.958616][ T54] worker_thread+0xa47/0xfb0 [ 95.960708][ T54] kthread+0x38b/0x480 [ 95.962687][ T54] ret_from_fork+0x514/0xb70 [ 95.964602][ T54] ret_from_fork_asm+0x1a/0x30 [ 95.966766][ T54] [ 95.966766][ T54] -> #2 ((wq_completion)md_misc){+.+.}-{0:0}: [ 95.969967][ T54] touch_wq_lockdep_map+0xcb/0x180 [ 95.972414][ T54] __flush_workqueue+0x148/0x1470 [ 95.974691][ T54] md_alloc+0x32/0xf20 [ 95.976451][ T54] md_alloc_and_put+0x1a/0x1f0 [ 95.978540][ T54] blk_request_module+0x27d/0x2a0 [ 95.981098][ T54] blkdev_get_no_open+0x3f/0xe0 [ 95.983549][ T54] blkdev_open+0x1d7/0x600 [ 95.985850][ T54] do_dentry_open+0x816/0x1380 [ 95.988288][ T54] vfs_open+0x3b/0x340 [ 95.990332][ T54] path_openat+0x1443/0x1d60 [ 95.992563][ T54] do_file_open+0x23e/0x4a0 [ 95.994655][ T54] do_sys_openat2+0x115/0x200 [ 95.996787][ T54] __x64_sys_openat+0x138/0x170 [ 95.998890][ T54] do_syscall_64+0x166/0x520 [ 96.000870][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.003439][ T54] [ 96.003439][ T54] -> #1 (major_names_lock){+.+.}-{4:4}: [ 96.006476][ T54] __mutex_lock+0x19d/0x1550 [ 96.008759][ T54] blk_request_module+0x35/0x2a0 [ 96.010934][ T54] blkdev_get_no_open+0x3f/0xe0 [ 96.013327][ T54] bdev_file_open_by_dev+0xa0/0x240 [ 96.015733][ T54] md_import_device+0x2e9/0x650 [ 96.018009][ T54] hot_add_disk+0xa7/0x4b0 [ 96.020051][ T54] md_ioctl+0x1e5e/0x2610 [ 96.022181][ T54] blkdev_ioctl+0x5e3/0x740 [ 96.024234][ T54] __se_sys_ioctl+0xfc/0x170 [ 96.026226][ T54] do_syscall_64+0x166/0x520 [ 96.028422][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.031081][ T54] [ 96.031081][ T54] -> #0 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 96.034395][ T54] __lock_acquire+0x164c/0x2de0 [ 96.036771][ T54] lock_acquire+0x115/0x350 [ 96.039004][ T54] __mutex_lock+0x19d/0x1550 [ 96.041357][ T54] md_start_sync+0x179/0x1010 [ 96.043741][ T54] process_scheduled_works+0xc3d/0x1630 [ 96.046543][ T54] worker_thread+0xa47/0xfb0 [ 96.048963][ T54] kthread+0x38b/0x480 [ 96.051038][ T54] ret_from_fork+0x514/0xb70 [ 96.053297][ T54] ret_from_fork_asm+0x1a/0x30 [ 96.055598][ T54] [ 96.055598][ T54] other info that might help us debug this: [ 96.055598][ T54] [ 96.060144][ T54] Chain exists of: [ 96.060144][ T54] &mddev->reconfig_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->sync_work) [ 96.060144][ T54] [ 96.067572][ T54] Possible unsafe locking scenario: [ 96.067572][ T54] [ 96.071007][ T54] CPU0 CPU1 [ 96.073613][ T54] ---- ---- [ 96.076390][ T54] lock((work_completion)(&mddev->sync_work)); [ 96.079756][ T54] lock((wq_completion)md_misc); [ 96.083535][ T54] lock((work_completion)(&mddev->sync_work)); [ 96.087461][ T54] lock(&mddev->reconfig_mutex); [ 96.089747][ T54] [ 96.089747][ T54] *** DEADLOCK *** [ 96.089747][ T54] [ 96.093073][ T54] locks held by kworker/0:2/54: 2, last CPU#0: [ 96.095653][ T54] #0: ffff88801fbf2940 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 96.100003][ T54] #1: ffffc90000af7c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 96.105021][ T54] [ 96.105021][ T54] stack backtrace: [ 96.107559][ T54] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 96.111446][ T54] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.115848][ T54] Workqueue: md_misc md_start_sync [ 96.118074][ T54] Call Trace: [ 96.119468][ T54] [ 96.120634][ T54] dump_stack_lvl+0xe8/0x150 [ 96.122416][ T54] print_circular_bug+0x2e2/0x300 [ 96.124478][ T54] check_noncircular+0x12f/0x150 [ 96.126443][ T54] __lock_acquire+0x164c/0x2de0 [ 96.128364][ T54] ? unwind_next_frame+0x8f/0x2550 [ 96.130255][ T54] ? unwind_next_frame+0x1baf/0x2550 [ 96.132394][ T54] ? ret_from_fork_asm+0x1a/0x30 [ 96.134599][ T54] ? unwind_next_frame+0x8f/0x2550 [ 96.136746][ T54] lock_acquire+0x115/0x350 [ 96.138857][ T54] ? md_start_sync+0x179/0x1010 [ 96.141075][ T54] __mutex_lock+0x19d/0x1550 [ 96.143234][ T54] ? md_start_sync+0x179/0x1010 [ 96.145512][ T54] ? check_path+0x21/0x40 [ 96.147561][ T54] ? md_start_sync+0x179/0x1010 [ 96.149804][ T54] ? __pfx___mutex_lock+0x10/0x10 [ 96.152081][ T54] ? md_spares_need_change+0x1c/0x240 [ 96.154488][ T54] ? md_spares_need_change+0x1c/0x240 [ 96.156863][ T54] md_start_sync+0x179/0x1010 [ 96.158984][ T54] ? lock_acquire+0x115/0x350 [ 96.161105][ T54] ? __pfx_md_start_sync+0x10/0x10 [ 96.163370][ T54] ? rcu_is_watching+0x16/0xb0 [ 96.165482][ T54] ? process_scheduled_works+0x97a/0x1630 [ 96.167778][ T54] process_scheduled_works+0xc3d/0x1630 [ 96.170171][ T54] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.172565][ T54] ? assign_work+0x3cf/0x5d0 [ 96.174521][ T54] worker_thread+0xa47/0xfb0 [ 96.176595][ T54] kthread+0x38b/0x480 [ 96.178306][ T54] ? __pfx_worker_thread+0x10/0x10 [ 96.180561][ T54] ? __pfx_kthread+0x10/0x10 [ 96.182613][ T54] ret_from_fork+0x514/0xb70 [ 96.184635][ T54] ? __pfx_ret_from_fork+0x10/0x10 [ 96.186868][ T54] ? __switch_to+0xc89/0x1420 [ 96.188768][ T54] ? __pfx_kthread+0x10/0x10 [ 96.190532][ T54] ret_from_fork_asm+0x1a/0x30 [ 96.192780][ T54] [ 96.204145][ T5324] md: couldn't update array info. -22 [ 96.204647][ T5326] md: could not open device unknown-block(1,1). [ 96.204677][ T5326] md: md_import_device returned -16 [ 96.223696][ T5333] md: resync of RAID array md0 [ 96.254971][ T5333] md: md0: resync done. [ 96.277495][ T5328] md: could not open device unknown-block(0,0). [ 96.277532][ T5328] md: error, md_import_device() returned -6