program: syz_open_procfs(0xffffffffffffffff, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000000c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x80201, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x190, 0x138, 0x1, 0x0, 0x10, 0x0, 0x0, @by_dev={r1}, [@multipath={0x0, 0x884, 0x0, 0x58, 'multipath\x00', {'0', 0x20, '0'}}]}) socket(0x10, 0x803, 0x0) ioctl$DM_DEV_REMOVE(r0, 0xc138fd04, &(0x7f0000000cc0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x9c10, 0x0, 0x0, @by_dev={r1}}) [ 86.111236][ T4666] Bluetooth: hci0: command tx timeout [ 86.350587][ T5348] [ 86.351757][ T5348] ====================================================== [ 86.354948][ T5348] WARNING: possible circular locking dependency detected [ 86.358193][ T5348] syzkaller #0 Not tainted [ 86.360202][ T5348] ------------------------------------------------------ [ 86.363285][ T5348] syz.0.0/5348 is trying to acquire lock: [ 86.365777][ T5348] ffff88803536dc78 (&q->debugfs_mutex){+.+.}-{4:4}, at: wbt_init_enable_default+0x146/0x220 [ 86.370248][ T5348] [ 86.370248][ T5348] but task is already holding lock: [ 86.373418][ T5348] ffff88803536d430 (&q->q_usage_counter(io)#40){++++}-{0:0}, at: rq_qos_add+0x15b/0x370 [ 86.377561][ T5348] [ 86.377561][ T5348] which lock already depends on the new lock. [ 86.377561][ T5348] [ 86.382079][ T5348] [ 86.382079][ T5348] the existing dependency chain (in reverse order) is: [ 86.385915][ T5348] [ 86.385915][ T5348] -> #3 (&q->q_usage_counter(io)#40){++++}-{0:0}: [ 86.389534][ T5348] blk_alloc_queue+0x544/0x690 [ 86.391889][ T5348] __blk_alloc_disk+0xe3/0x1d0 [ 86.394095][ T5348] dm_create+0x476/0xf70 [ 86.397266][ T5348] dev_create+0x1f7/0x400 [ 86.399443][ T5348] dm_ctl_ioctl+0x9ec/0xe10 [ 86.401653][ T5348] __se_sys_ioctl+0xfc/0x170 [ 86.404094][ T5348] do_syscall_64+0x166/0x520 [ 86.406433][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.409063][ T5348] [ 86.409063][ T5348] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 86.412172][ T5348] fs_reclaim_acquire+0x71/0x100 [ 86.414441][ T5348] kmem_cache_alloc_lru_noprof+0x65/0x5f0 [ 86.417159][ T5348] __d_alloc+0x37/0x820 [ 86.419181][ T5348] d_alloc+0x4b/0x190 [ 86.421128][ T5348] lookup_one_qstr_excl+0xd8/0x360 [ 86.423537][ T5348] start_dirop+0x5c/0x90 [ 86.425443][ T5348] simple_start_creating+0xcc/0x110 [ 86.427939][ T5348] debugfs_start_creating+0xca/0x1b0 [ 86.430533][ T5348] debugfs_create_dir+0x24/0x350 [ 86.432911][ T5348] regulator_init+0x6c/0x110 [ 86.435217][ T5348] do_one_initcall+0x250/0x870 [ 86.437548][ T5348] do_initcall_level+0x10a/0x1a0 [ 86.439982][ T5348] do_initcalls+0x59/0xa0 [ 86.442293][ T5348] kernel_init_freeable+0x29d/0x3e0 [ 86.444818][ T5348] kernel_init+0x22/0x1d0 [ 86.446989][ T5348] ret_from_fork+0x514/0xb70 [ 86.449215][ T5348] ret_from_fork_asm+0x1a/0x30 [ 86.451355][ T5348] [ 86.451355][ T5348] -> #1 (&sb->s_type->i_mutex_key#3/1){+.+.}-{4:4}: [ 86.455213][ T5348] down_write_nested+0x98/0x200 [ 86.458323][ T5348] start_dirop+0x4f/0x90 [ 86.460720][ T5348] simple_start_creating+0xcc/0x110 [ 86.463621][ T5348] debugfs_start_creating+0xca/0x1b0 [ 86.466832][ T5348] debugfs_create_dir+0x24/0x350 [ 86.469329][ T5348] blk_register_queue+0x189/0x4f0 [ 86.471749][ T5348] __add_disk+0x6b8/0xdb0 [ 86.473952][ T5348] add_disk_fwnode+0x143/0x3a0 [ 86.476317][ T5348] brd_alloc+0x5a9/0x7c0 [ 86.478469][ T5348] brd_init+0xc1/0x120 [ 86.480494][ T5348] do_one_initcall+0x250/0x870 [ 86.482779][ T5348] do_initcall_level+0x10a/0x1a0 [ 86.485151][ T5348] do_initcalls+0x59/0xa0 [ 86.487276][ T5348] kernel_init_freeable+0x29d/0x3e0 [ 86.489758][ T5348] kernel_init+0x22/0x1d0 [ 86.491894][ T5348] ret_from_fork+0x514/0xb70 [ 86.494100][ T5348] ret_from_fork_asm+0x1a/0x30 [ 86.496541][ T5348] [ 86.496541][ T5348] -> #0 (&q->debugfs_mutex){+.+.}-{4:4}: [ 86.500058][ T5348] __lock_acquire+0x164c/0x2de0 [ 86.502674][ T5348] lock_acquire+0x115/0x350 [ 86.505163][ T5348] __mutex_lock+0x197/0x15a0 [ 86.507628][ T5348] wbt_init_enable_default+0x146/0x220 [ 86.510191][ T5348] blk_register_queue+0x420/0x4f0 [ 86.512555][ T5348] __add_disk+0x6b8/0xdb0 [ 86.514743][ T5348] add_disk_fwnode+0x100/0x3a0 [ 86.516923][ T5348] dm_setup_md_queue+0x23d/0x4f0 [ 86.519363][ T5348] table_load+0x4fd/0x8a0 [ 86.521420][ T5348] dm_ctl_ioctl+0x9ec/0xe10 [ 86.523525][ T5348] __se_sys_ioctl+0xfc/0x170 [ 86.525791][ T5348] do_syscall_64+0x166/0x520 [ 86.528029][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.530846][ T5348] [ 86.530846][ T5348] other info that might help us debug this: [ 86.530846][ T5348] [ 86.535290][ T5348] Chain exists of: [ 86.535290][ T5348] &q->debugfs_mutex --> fs_reclaim --> &q->q_usage_counter(io)#40 [ 86.535290][ T5348] [ 86.540906][ T5348] Possible unsafe locking scenario: [ 86.540906][ T5348] [ 86.543874][ T5348] CPU0 CPU1 [ 86.545936][ T5348] ---- ---- [ 86.548152][ T5348] lock(&q->q_usage_counter(io)#40); [ 86.550302][ T5348] lock(fs_reclaim); [ 86.552959][ T5348] lock(&q->q_usage_counter(io)#40); [ 86.556430][ T5348] lock(&q->debugfs_mutex); [ 86.558552][ T5348] [ 86.558552][ T5348] *** DEADLOCK *** [ 86.558552][ T5348] [ 86.561996][ T5348] locks held by syz.0.0/5348: 6, last CPU#0: [ 86.564516][ T5348] #0: ffff888014570190 (&md->type_lock){+.+.}-{4:4}, at: table_load+0x1dd/0x8a0 [ 86.568382][ T5348] #1: ffff8880145700e8 (&md->table_devices_lock){+.+.}-{4:4}, at: dm_setup_md_queue+0x20b/0x4f0 [ 86.573003][ T5348] #2: ffff888040ed55c0 (&set->update_nr_hwq_lock){.+.+}-{4:4}, at: add_disk_fwnode+0xea/0x3a0 [ 86.577384][ T5348] #3: ffff88803536d9e0 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x10d/0x4f0 [ 86.581769][ T5348] #4: ffff88803536d430 (&q->q_usage_counter(io)#40){++++}-{0:0}, at: rq_qos_add+0x15b/0x370 [ 86.586215][ T5348] #5: ffff88803536d468 (&q->q_usage_counter(queue)#22){+.+.}-{0:0}, at: rq_qos_add+0x15b/0x370 [ 86.590732][ T5348] [ 86.590732][ T5348] stack backtrace: [ 86.593367][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.597414][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.601766][ T5348] Call Trace: [ 86.603290][ T5348] [ 86.604620][ T5348] dump_stack_lvl+0xe8/0x150 [ 86.606682][ T5348] print_circular_bug+0x2e2/0x300 [ 86.608948][ T5348] check_noncircular+0x12f/0x150 [ 86.611129][ T5348] __lock_acquire+0x164c/0x2de0 [ 86.613112][ T5348] ? __lock_acquire+0x1511/0x2de0 [ 86.615240][ T5348] lock_acquire+0x115/0x350 [ 86.617255][ T5348] ? wbt_init_enable_default+0x146/0x220 [ 86.619816][ T5348] __mutex_lock+0x197/0x15a0 [ 86.621868][ T5348] ? wbt_init_enable_default+0x146/0x220 [ 86.624259][ T5348] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.626435][ T5348] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 86.628885][ T5348] ? wbt_init_enable_default+0x146/0x220 [ 86.631380][ T5348] ? __pfx___mutex_lock+0x10/0x10 [ 86.633675][ T5348] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 86.636340][ T5348] ? wbt_init+0x329/0x450 [ 86.638392][ T5348] wbt_init_enable_default+0x146/0x220 [ 86.640853][ T5348] blk_register_queue+0x420/0x4f0 [ 86.643161][ T5348] __add_disk+0x6b8/0xdb0 [ 86.645110][ T5348] add_disk_fwnode+0x100/0x3a0 [ 86.647333][ T5348] dm_setup_md_queue+0x23d/0x4f0 [ 86.649594][ T5348] ? dm_table_complete+0x1d84/0x22d0 [ 86.651939][ T5348] ? __pfx_dm_setup_md_queue+0x10/0x10 [ 86.654270][ T5348] ? __pfx_dm_table_complete+0x10/0x10 [ 86.656640][ T5348] table_load+0x4fd/0x8a0 [ 86.658489][ T5348] ? __pfx_table_load+0x10/0x10 [ 86.660551][ T5348] ? __might_fault+0xaf/0x130 [ 86.662559][ T5348] dm_ctl_ioctl+0x9ec/0xe10 [ 86.664570][ T5348] ? __pfx_table_load+0x10/0x10 [ 86.666705][ T5348] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.669050][ T5348] ? __fget_files+0x2a/0x420 [ 86.671154][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.673368][ T5348] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.675507][ T5348] __se_sys_ioctl+0xfc/0x170 [ 86.677449][ T5348] do_syscall_64+0x166/0x520 [ 86.679618][ T5348] ? trace_irq_disable+0x3b/0x140 [ 86.681748][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.684304][ T5348] ? clear_bhb_loop+0x70/0xc0 [ 86.686415][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.688823][ T5348] RIP: 0033:0x7f255979fb19 [ 86.690676][ T5348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.698550][ T5348] RSP: 002b:00007f255a5fffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.701932][ T5348] RAX: ffffffffffffffda RBX: 00007f2559a25fa0 RCX: 00007f255979fb19 [ 86.705257][ T5348] RDX: 0000200000000200 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 86.708730][ T5348] RBP: 00007f2559837b70 R08: 0000000000000000 R09: 0000000000000000 [ 86.712161][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.715453][ T5348] R13: 00007f2559a26038 R14: 00007f2559a25fa0 R15: 00007ffed5a5a518 [ 86.719367][ T5348] [ 86.737474][ T5348] device-mapper: ioctl: device has been removed from the dev hash table.