program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1d4) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./bus\x00', 0x400e, &(0x7f0000000280)={[{@i_version}, {@nobh}, {@data_err_ignore}, {@nolazytime}, {@init_itable_val={'init_itable', 0x3d, 0x4}}, {@acl}]}, 0x1, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ftruncate(r4, 0x2000009) write$cgroup_int(r3, &(0x7f00000000c0), 0x12) write$binfmt_script(r4, &(0x7f0000000140), 0xfcb8) ioctl$EXT4_IOC_MOVE_EXT(r3, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0x100000001}) ioctl$EXT4_IOC_MOVE_EXT(r2, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x0, 0x100000001, 0x0, 0x6}) ioctl(r1, 0x40140921, &(0x7f0000000440)) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x0, 0x3) [ 94.940521][ T5285] Bluetooth: hci0: command tx timeout [ 95.208652][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.210946][ T5325] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.214795][ T5325] block device autoloading is deprecated and will be removed. [ 95.308431][ T5325] loop0: detected capacity change from 0 to 512 [ 95.335841][ T5325] EXT4-fs: Ignoring removed i_version option [ 95.344480][ T5325] EXT4-fs: Ignoring removed nobh option [ 95.367795][ T5325] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 95.392321][ T5325] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 95.408530][ T5324] md/raid10:md0: not clean -- starting background reconstruction [ 95.412550][ T5324] md/raid10:md0: active with 1 out of 2 devices [ 95.425987][ T5324] md0: detected capacity change from 0 to 2048 [ 95.440210][ T5333] md: resync of RAID array md0 [ 95.465414][ T5325] EXT4-fs (loop0): 1 truncate cleaned up [ 95.481104][ T5325] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.528127][ T5333] md: md0: resync done. [ 95.596680][ T5324] [ 95.597792][ T5324] ====================================================== [ 95.600799][ T5324] WARNING: possible circular locking dependency detected [ 95.603784][ T5324] syzkaller #0 Not tainted [ 95.605673][ T5324] ------------------------------------------------------ [ 95.608529][ T5324] syz.0.0/5324 is trying to acquire lock: [ 95.610935][ T5324] ffffffff8f553640 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 95.615084][ T5324] [ 95.615084][ T5324] but task is already holding lock: [ 95.618300][ T5324] ffff888034936358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.622865][ T5324] [ 95.622865][ T5324] which lock already depends on the new lock. [ 95.622865][ T5324] [ 95.627469][ T5324] [ 95.627469][ T5324] the existing dependency chain (in reverse order) is: [ 95.631416][ T5324] [ 95.631416][ T5324] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 95.635088][ T5324] __mutex_lock+0x19d/0x1550 [ 95.637354][ T5324] md_start_sync+0x179/0x1010 [ 95.639677][ T5324] process_scheduled_works+0xc3d/0x1630 [ 95.642348][ T5324] worker_thread+0xa47/0xfb0 [ 95.644671][ T5324] kthread+0x38b/0x480 [ 95.646605][ T5324] ret_from_fork+0x514/0xb70 [ 95.648781][ T5324] ret_from_fork_asm+0x1a/0x30 [ 95.651041][ T5324] [ 95.651041][ T5324] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 95.655019][ T5324] process_scheduled_works+0xc03/0x1630 [ 95.657667][ T5324] worker_thread+0xa47/0xfb0 [ 95.659906][ T5324] kthread+0x38b/0x480 [ 95.661900][ T5324] ret_from_fork+0x514/0xb70 [ 95.664245][ T5324] ret_from_fork_asm+0x1a/0x30 [ 95.666537][ T5324] [ 95.666537][ T5324] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 95.670172][ T5324] touch_wq_lockdep_map+0xcb/0x180 [ 95.672655][ T5324] __flush_workqueue+0x148/0x1470 [ 95.675713][ T5324] md_alloc+0x32/0xf20 [ 95.677827][ T5324] md_alloc_and_put+0x1a/0x1f0 [ 95.679987][ T5324] blk_request_module+0x27d/0x2a0 [ 95.682273][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 95.684389][ T5324] blkdev_open+0x1d7/0x600 [ 95.686165][ T5324] do_dentry_open+0x816/0x1380 [ 95.688463][ T5324] vfs_open+0x3b/0x340 [ 95.690475][ T5324] path_openat+0x1443/0x1d60 [ 95.692785][ T5324] do_file_open+0x23e/0x4a0 [ 95.695009][ T5324] do_sys_openat2+0x115/0x200 [ 95.697409][ T5324] __x64_sys_openat+0x138/0x170 [ 95.699940][ T5324] do_syscall_64+0x166/0x520 [ 95.702324][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.705206][ T5324] [ 95.705206][ T5324] -> #0 (major_names_lock){+.+.}-{4:4}: [ 95.708540][ T5324] __lock_acquire+0x15ff/0x2e50 [ 95.710808][ T5324] lock_acquire+0x115/0x350 [ 95.713271][ T5324] __mutex_lock+0x19d/0x1550 [ 95.715683][ T5324] blk_request_module+0x35/0x2a0 [ 95.718233][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 95.720935][ T5324] bdev_file_open_by_dev+0xa0/0x240 [ 95.723431][ T5324] md_import_device+0x2e9/0x650 [ 95.725636][ T5324] md_add_new_disk+0x669/0x1850 [ 95.727662][ T5324] md_ioctl+0x200a/0x2610 [ 95.729656][ T5324] blkdev_ioctl+0x5e3/0x740 [ 95.731866][ T5324] __se_sys_ioctl+0xfc/0x170 [ 95.734157][ T5324] do_syscall_64+0x166/0x520 [ 95.736370][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.738945][ T5324] [ 95.738945][ T5324] other info that might help us debug this: [ 95.738945][ T5324] [ 95.742951][ T5324] Chain exists of: [ 95.742951][ T5324] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 95.742951][ T5324] [ 95.749703][ T5324] Possible unsafe locking scenario: [ 95.749703][ T5324] [ 95.753082][ T5324] CPU0 CPU1 [ 95.755516][ T5324] ---- ---- [ 95.757881][ T5324] lock(&mddev->reconfig_mutex); [ 95.760066][ T5324] lock((work_completion)(&mddev->sync_work)); [ 95.763600][ T5324] lock(&mddev->reconfig_mutex); [ 95.766617][ T5324] lock(major_names_lock); [ 95.768585][ T5324] [ 95.768585][ T5324] *** DEADLOCK *** [ 95.768585][ T5324] [ 95.772143][ T5324] locks held by syz.0.0/5324: 1, last CPU#0: [ 95.774832][ T5324] #0: ffff888034936358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.779551][ T5324] [ 95.779551][ T5324] stack backtrace: [ 95.782150][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.786033][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.790514][ T5324] Call Trace: [ 95.792023][ T5324] [ 95.793330][ T5324] dump_stack_lvl+0xe8/0x150 [ 95.795355][ T5324] print_circular_bug+0x2e2/0x300 [ 95.797684][ T5324] check_noncircular+0x12f/0x150 [ 95.799959][ T5324] __lock_acquire+0x15ff/0x2e50 [ 95.802161][ T5324] ? post_alloc_hook+0x208/0x250 [ 95.804431][ T5324] ? get_page_from_freelist+0x2209/0x2280 [ 95.807591][ T5324] lock_acquire+0x115/0x350 [ 95.809641][ T5324] ? blk_request_module+0x35/0x2a0 [ 95.811882][ T5324] __mutex_lock+0x19d/0x1550 [ 95.813912][ T5324] ? blk_request_module+0x35/0x2a0 [ 95.816305][ T5324] ? lock_acquire+0x115/0x350 [ 95.818346][ T5324] ? blk_request_module+0x35/0x2a0 [ 95.820621][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 95.822735][ T5324] ? find_inode_fast+0x5dc/0x740 [ 95.824873][ T5324] ? find_inode_fast+0xd2/0x740 [ 95.826937][ T5324] blk_request_module+0x35/0x2a0 [ 95.829138][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 95.831284][ T5324] bdev_file_open_by_dev+0xa0/0x240 [ 95.833586][ T5324] md_import_device+0x2e9/0x650 [ 95.835811][ T5324] md_add_new_disk+0x669/0x1850 [ 95.837922][ T5324] md_ioctl+0x200a/0x2610 [ 95.839883][ T5324] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.842357][ T5324] ? __pfx_md_ioctl+0x10/0x10 [ 95.844440][ T5324] ? do_vfs_ioctl+0x116f/0x1530 [ 95.846503][ T5324] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.848598][ T5324] ? hook_file_ioctl+0x1f2/0x600 [ 95.850803][ T5324] ? __pfx_md_ioctl+0x10/0x10 [ 95.852923][ T5324] blkdev_ioctl+0x5e3/0x740 [ 95.854970][ T5324] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.857139][ T5324] ? __fget_files+0x2a/0x420 [ 95.859050][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.861091][ T5324] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.863167][ T5324] __se_sys_ioctl+0xfc/0x170 [ 95.865138][ T5324] do_syscall_64+0x166/0x520 [ 95.867028][ T5324] ? trace_irq_disable+0x3b/0x140 [ 95.869098][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.871718][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 95.873751][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.876386][ T5324] RIP: 0033:0x7f98d8b9e159 [ 95.878255][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.886235][ T5324] RSP: 002b:00007f98d9a4cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.889758][ T5324] RAX: ffffffffffffffda RBX: 00007f98d8e25fa0 RCX: 00007f98d8b9e159 [ 95.893129][ T5324] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 95.896456][ T5324] RBP: 00007f98d8c35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.899786][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.902817][ T5324] R13: 00007f98d8e26038 R14: 00007f98d8e25fa0 R15: 00007ffd2efb3f28 [ 95.905896][ T5324] [ 95.979172][ T5324] md: could not open device unknown-block(0,0). [ 95.981974][ T5324] md: md_import_device returned -6