program: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000001c0)={'pim6reg1\x00', @remote}) write(r1, &(0x7f0000000200)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r6, @ANYBLOB="05005300000000000800050008"], 0x2c}}, 0x0) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x2c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_FLAGS={0x4}]}, 0x2c}}, 0x800) [ 93.009419][ T5281] Bluetooth: hci0: command tx timeout [ 93.039663][ T1910] cfg80211: failed to load regulatory.db [ 93.186209][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 93.189331][ T5318] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 93.189465][ T5318] block device autoloading is deprecated and will be removed. [ 93.267892][ T5317] md/raid10:md0: not clean -- starting background reconstruction [ 93.267908][ T5317] md/raid10:md0: active with 1 out of 2 devices [ 93.280602][ T5317] md0: detected capacity change from 0 to 2048 [ 93.294253][ T5318] [ 93.295319][ T5318] ====================================================== [ 93.298149][ T5318] WARNING: possible circular locking dependency detected [ 93.301179][ T5318] syzkaller #0 Not tainted [ 93.303181][ T5318] ------------------------------------------------------ [ 93.306356][ T5318] syz.0.0/5318 is trying to acquire lock: [ 93.308898][ T5318] ffffffff8f556400 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 93.313065][ T5318] [ 93.313065][ T5318] but task is already holding lock: [ 93.316755][ T5318] ffff8880138f4358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 93.321435][ T5318] [ 93.321435][ T5318] which lock already depends on the new lock. [ 93.321435][ T5318] [ 93.325975][ T5318] [ 93.325975][ T5318] the existing dependency chain (in reverse order) is: [ 93.329933][ T5318] [ 93.329933][ T5318] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 93.333607][ T5318] __mutex_lock+0x19d/0x1550 [ 93.335880][ T5318] md_start_sync+0x179/0x1010 [ 93.338163][ T5318] process_scheduled_works+0xc3d/0x1630 [ 93.340915][ T5318] worker_thread+0xa47/0xfb0 [ 93.343024][ T5318] kthread+0x38b/0x480 [ 93.344859][ T5318] ret_from_fork+0x514/0xb70 [ 93.347026][ T5318] ret_from_fork_asm+0x1a/0x30 [ 93.349179][ T5318] [ 93.349179][ T5318] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 93.353268][ T5318] process_scheduled_works+0xc03/0x1630 [ 93.355953][ T5318] worker_thread+0xa47/0xfb0 [ 93.358169][ T5318] kthread+0x38b/0x480 [ 93.360296][ T5318] ret_from_fork+0x514/0xb70 [ 93.362624][ T5318] ret_from_fork_asm+0x1a/0x30 [ 93.364740][ T5318] [ 93.364740][ T5318] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 93.368149][ T5318] touch_wq_lockdep_map+0xcb/0x180 [ 93.370471][ T5318] __flush_workqueue+0x148/0x1470 [ 93.372728][ T5318] md_alloc+0x32/0xf20 [ 93.374740][ T5318] md_alloc_and_put+0x1a/0x1f0 [ 93.377004][ T5318] blk_request_module+0x27d/0x2a0 [ 93.379183][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 93.381429][ T5318] blkdev_open+0x1d7/0x600 [ 93.383430][ T5318] do_dentry_open+0x816/0x1380 [ 93.385541][ T5318] vfs_open+0x3b/0x340 [ 93.387673][ T5318] path_openat+0x1443/0x1d60 [ 93.389935][ T5318] do_file_open+0x23e/0x4a0 [ 93.392317][ T5318] do_sys_openat2+0x115/0x200 [ 93.394696][ T5318] __x64_sys_openat+0x138/0x170 [ 93.397245][ T5318] do_syscall_64+0x166/0x520 [ 93.399509][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.402496][ T5318] [ 93.402496][ T5318] -> #0 (major_names_lock){+.+.}-{4:4}: [ 93.405727][ T5318] __lock_acquire+0x164c/0x2de0 [ 93.407872][ T5318] lock_acquire+0x115/0x350 [ 93.409877][ T5318] __mutex_lock+0x19d/0x1550 [ 93.411934][ T5318] blk_request_module+0x35/0x2a0 [ 93.414179][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 93.416317][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 93.418866][ T5318] md_import_device+0x2e9/0x650 [ 93.421713][ T5318] md_add_new_disk+0x669/0x1850 [ 93.424036][ T5318] md_ioctl+0x200a/0x2610 [ 93.426208][ T5318] blkdev_ioctl+0x5e3/0x740 [ 93.428451][ T5318] __se_sys_ioctl+0xfc/0x170 [ 93.430871][ T5318] do_syscall_64+0x166/0x520 [ 93.433121][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.435906][ T5318] [ 93.435906][ T5318] other info that might help us debug this: [ 93.435906][ T5318] [ 93.440311][ T5318] Chain exists of: [ 93.440311][ T5318] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 93.440311][ T5318] [ 93.447668][ T5318] Possible unsafe locking scenario: [ 93.447668][ T5318] [ 93.451377][ T5318] CPU0 CPU1 [ 93.453744][ T5318] ---- ---- [ 93.455965][ T5318] lock(&mddev->reconfig_mutex); [ 93.458135][ T5318] lock((work_completion)(&mddev->sync_work)); [ 93.462063][ T5318] lock(&mddev->reconfig_mutex); [ 93.465366][ T5318] lock(major_names_lock); [ 93.467459][ T5318] [ 93.467459][ T5318] *** DEADLOCK *** [ 93.467459][ T5318] [ 93.471094][ T5318] locks held by syz.0.0/5318: 1, last CPU#0: [ 93.473767][ T5318] #0: ffff8880138f4358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 93.478458][ T5318] [ 93.478458][ T5318] stack backtrace: [ 93.481193][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.485226][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.489571][ T5318] Call Trace: [ 93.491178][ T5318] [ 93.492677][ T5318] dump_stack_lvl+0xe8/0x150 [ 93.494811][ T5318] print_circular_bug+0x2e2/0x300 [ 93.497186][ T5318] check_noncircular+0x12f/0x150 [ 93.499203][ T5318] __lock_acquire+0x164c/0x2de0 [ 93.501231][ T5318] ? post_alloc_hook+0x208/0x250 [ 93.503413][ T5318] ? get_page_from_freelist+0x2209/0x2280 [ 93.506036][ T5318] lock_acquire+0x115/0x350 [ 93.508057][ T5318] ? blk_request_module+0x35/0x2a0 [ 93.510258][ T5318] __mutex_lock+0x19d/0x1550 [ 93.512246][ T5318] ? blk_request_module+0x35/0x2a0 [ 93.514445][ T5318] ? lock_acquire+0x115/0x350 [ 93.516400][ T5318] ? blk_request_module+0x35/0x2a0 [ 93.518566][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 93.520788][ T5318] ? find_inode_fast+0x5dc/0x740 [ 93.522960][ T5318] ? find_inode_fast+0xd2/0x740 [ 93.525121][ T5318] blk_request_module+0x35/0x2a0 [ 93.527389][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 93.529594][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 93.531914][ T5318] md_import_device+0x2e9/0x650 [ 93.534051][ T5318] md_add_new_disk+0x669/0x1850 [ 93.536227][ T5318] md_ioctl+0x200a/0x2610 [ 93.538214][ T5318] ? tomoyo_path_number_perm+0x219/0x5f0 [ 93.540665][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 93.542801][ T5318] ? do_vfs_ioctl+0x116f/0x1530 [ 93.545006][ T5318] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 93.547205][ T5318] ? hook_file_ioctl+0x1f2/0x600 [ 93.549453][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 93.551627][ T5318] blkdev_ioctl+0x5e3/0x740 [ 93.553672][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.555912][ T5318] ? __fget_files+0x2a/0x420 [ 93.557998][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.560112][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.562216][ T5318] __se_sys_ioctl+0xfc/0x170 [ 93.564172][ T5318] do_syscall_64+0x166/0x520 [ 93.566284][ T5318] ? trace_irq_disable+0x3b/0x140 [ 93.568444][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.571210][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 93.573502][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.576215][ T5318] RIP: 0033:0x7f9dced9e159 [ 93.578459][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.587111][ T5318] RSP: 002b:00007f9dcfc24fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.590808][ T5318] RAX: ffffffffffffffda RBX: 00007f9dcf026090 RCX: 00007f9dced9e159 [ 93.595012][ T5318] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000005 [ 93.598524][ T5318] RBP: 00007f9dcee3506b R08: 0000000000000000 R09: 0000000000000000 [ 93.602343][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.606228][ T5318] R13: 00007f9dcf026128 R14: 00007f9dcf026090 R15: 00007ffd97f2ed98 [ 93.610372][ T5318] [ 93.614756][ T5321] md: resync of RAID array md0 [ 93.635903][ T5321] md: md0: resync done. [ 93.692343][ T5318] md: could not open device unknown-block(0,0). [ 93.692382][ T5318] md: md_import_device returned -6