program: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x2200054, &(0x7f0000000140)={[{@minixdf}, {@nodelalloc}]}, 0x1, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/md_mod/parameters/new_array\x00', 0x101081, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, 0x0, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/12], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r2, 0x400c0930, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x804810, &(0x7f0000000a40), 0x26, 0x75c, &(0x7f0000000b00)="$eJzs3M1rHGUYAPBnJtmkTaMbQfDjIEILFko3SXNpT40Xb4VCwWsNySSETLIhu6ndWLD1LNTmoiCIePboVSj1D/AmBQXvgmiNB/GyMptNatNsum3Srqa/H0z3eefjfd6nO7zsQN4J4Ln1ZvFPEjEcERcjotzen0bEQCs6EnF987yNe9emiy2JZvPSb0lxWWw0y9t9Je3PY9G6JF6NiDuliFMfPZy31lhbmMrzbKXdHq0vLo/WGmtD84tTc9lctjQ+cW7s7MTE2bGJR9bwSpe1nnj33NFb37+zvv7DN/Wbb/SfTmKyVXe0a+uym8ey+X9Siskd+5eeRrIeSno9AAAAulL8zu+LiP7Wr9Ry9LUiAAAA4DBpDjYBAACAQy+JPQ4e2esgAAAA8P+w9XcAW2t7n9Y62E5+fTsiRnbL399aQxxxJEoRMbSRPLAyIdm8DPbl+o2IuD258/77qrjDru+z77Ed7QfXSA/ss3cOwu1i/pncbf5Jt+ef2GX+6d96d8I+dZ7/7ufv6zD/Xewyx7dfvFbqmP9GxOv9u+VPtvMnHfK/12X+m+sf33rUObvl/3eurfdDnH74/RCTs/P5nq8fuPP3ybudjhX1D3XK3+q1c/3LXdRe+GDjj4VOc0mR/+Txvb//3fIX98Qn7XGkEXGr/Vm013fkOL7443d71T8T0XyS7//LLuv/+evBq12eCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1pRAxHkla24zStVCKORcTLMZTm1Vr91Gx1dWmmOBYxEqV0dj7PxiKivNlOivZ4K77fPrOjPRERL/10dDPpfJ5Vpqv5TK+LBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNuxiBiOJK1ERBoRf5bTtFKJ6O/i2sFnMD4AAADggIz0egAAAADAU+f5HwAAAA6/J33+Tw54HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMChdvHChWJrbty7Nl20Z640VheqV07PZLWFyuLqdGW6urJcmatW5/KsMl1dfFR/ebW6PH4uVq+O1rNafbTWWLu8WF1dql+eX5yayy5npWdSFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI9ruLUlaSUi0lacppVKxAsRMRKlZHY+z8Yi4sWIuFsuDRbt8V4PGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgANXa6wtTOV5tiIQCJ5Z8GFE/AeGsUfQ65kJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBeqDXWFqbyPFup9XokAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9Fb6SxIRxfZW+cTwjoN9A8lf5SIYiIj3P7/06dWpen1lPGIg+X17f/2z9v4zPSkAAAAAngfnH+fkref0red4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAbtUaawtTeZ6t7C84H421ZtLhnF7XCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPJl/AgAA///CK8Nb") chdir(&(0x7f00000001c0)='./file0\x00') ioctl(r2, 0x40140921, &(0x7f0000000440)) [ 133.276410][ T4646] Bluetooth: hci0: command tx timeout [ 133.377407][ T1026] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 133.377428][ T1026] ata1: failed to read log page 10h (errno=-5) [ 133.377443][ T1026] ata1.00: exception Emask 0x1 SAct 0x1800 SErr 0x0 action 0x0 [ 133.377454][ T1026] ata1.00: irq_stat 0x41000000 [ 133.377466][ T1026] ata1.00: failed command: WRITE FPDMA QUEUED [ 133.377473][ T1026] ata1.00: cmd 61/10:58:ee:13:08/11:00:00:00:00/40 tag 11 ncq dma 2236416 ou [ 133.377473][ T1026] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 133.377503][ T1026] ata1.00: status: { DRDY } [ 133.377512][ T1026] ata1.00: failed command: WRITE FPDMA QUEUED [ 133.377519][ T1026] ata1.00: cmd 61/48:60:56:05:10/00:00:00:00:00/40 tag 12 ncq dma 36864 out [ 133.377519][ T1026] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 133.377548][ T1026] ata1.00: status: { DRDY } [ 133.378593][ T1026] ata1.00: configured for UDMA/100 [ 133.430859][ T1026] ata1: EH complete [ 133.510683][ T5329] loop0: detected capacity change from 0 to 128 [ 133.567459][ T5329] ======================================================= [ 133.567459][ T5329] WARNING: The mand mount option has been deprecated and [ 133.567459][ T5329] and is ignored by this kernel. Remove the mand [ 133.567459][ T5329] option from the mount to silence this warning. [ 133.567459][ T5329] ======================================================= [ 133.689546][ T5329] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 133.693521][ T5329] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 133.818258][ T5330] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 133.824759][ T5330] block device autoloading is deprecated and will be removed. [ 133.826680][ T5329] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 133.948002][ T5329] md/raid10:md0: not clean -- starting background reconstruction [ 133.948021][ T5329] md/raid10:md0: active with 1 out of 2 devices [ 133.956342][ T5329] md0: detected capacity change from 0 to 2048 [ 133.982294][ T5335] md: resync of RAID array md0 [ 134.020427][ T5329] [ 134.021676][ T5329] ====================================================== [ 134.024643][ T5329] WARNING: possible circular locking dependency detected [ 134.027655][ T5329] syzkaller #0 Not tainted [ 134.029645][ T5329] ------------------------------------------------------ [ 134.032696][ T5329] syz.0.0/5329 is trying to acquire lock: [ 134.035227][ T5329] ffffffff8f556960 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 134.039383][ T5329] [ 134.039383][ T5329] but task is already holding lock: [ 134.042747][ T5329] ffff88804218c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 134.047202][ T5329] [ 134.047202][ T5329] which lock already depends on the new lock. [ 134.047202][ T5329] [ 134.051714][ T5329] [ 134.051714][ T5329] the existing dependency chain (in reverse order) is: [ 134.055556][ T5329] [ 134.055556][ T5329] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 134.059086][ T5329] __mutex_lock+0x19d/0x1550 [ 134.061277][ T5329] md_start_sync+0x179/0x1010 [ 134.063569][ T5329] process_scheduled_works+0xc3d/0x1630 [ 134.066217][ T5329] worker_thread+0xa47/0xfb0 [ 134.068458][ T5329] kthread+0x38b/0x480 [ 134.070485][ T5329] ret_from_fork+0x514/0xb70 [ 134.072716][ T5329] ret_from_fork_asm+0x1a/0x30 [ 134.074967][ T5329] [ 134.074967][ T5329] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 134.078950][ T5329] process_scheduled_works+0xc03/0x1630 [ 134.081650][ T5329] worker_thread+0xa47/0xfb0 [ 134.083878][ T5329] kthread+0x38b/0x480 [ 134.085860][ T5329] ret_from_fork+0x514/0xb70 [ 134.088054][ T5329] ret_from_fork_asm+0x1a/0x30 [ 134.090377][ T5329] [ 134.090377][ T5329] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 134.093909][ T5329] touch_wq_lockdep_map+0xcb/0x180 [ 134.096446][ T5329] __flush_workqueue+0x148/0x1470 [ 134.098984][ T5329] md_alloc+0x32/0xf20 [ 134.101169][ T5329] md_alloc_and_put+0x1a/0x1f0 [ 134.103526][ T5329] blk_request_module+0x27d/0x2a0 [ 134.105871][ T5329] blkdev_get_no_open+0x3f/0xe0 [ 134.108084][ T5329] blkdev_open+0x1d7/0x600 [ 134.110203][ T5329] do_dentry_open+0x816/0x1380 [ 134.112475][ T5329] vfs_open+0x3b/0x340 [ 134.114461][ T5329] path_openat+0x1443/0x1d60 [ 134.116637][ T5329] do_file_open+0x23e/0x4a0 [ 134.118807][ T5329] do_sys_openat2+0x115/0x200 [ 134.121200][ T5329] __x64_sys_openat+0x138/0x170 [ 134.123548][ T5329] do_syscall_64+0x166/0x520 [ 134.125724][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.128431][ T5329] [ 134.128431][ T5329] -> #0 (major_names_lock){+.+.}-{4:4}: [ 134.131658][ T5329] __lock_acquire+0x164c/0x2de0 [ 134.133899][ T5329] lock_acquire+0x115/0x350 [ 134.136066][ T5329] __mutex_lock+0x19d/0x1550 [ 134.138291][ T5329] blk_request_module+0x35/0x2a0 [ 134.140625][ T5329] blkdev_get_no_open+0x3f/0xe0 [ 134.143126][ T5329] bdev_file_open_by_dev+0xa0/0x240 [ 134.145667][ T5329] md_import_device+0x2e9/0x650 [ 134.148055][ T5329] md_add_new_disk+0x669/0x1850 [ 134.150347][ T5329] md_ioctl+0x1fe4/0x2610 [ 134.152509][ T5329] blkdev_ioctl+0x5e3/0x740 [ 134.154966][ T5329] __se_sys_ioctl+0xfc/0x170 [ 134.157181][ T5329] do_syscall_64+0x166/0x520 [ 134.159389][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.162128][ T5329] [ 134.162128][ T5329] other info that might help us debug this: [ 134.162128][ T5329] [ 134.166477][ T5329] Chain exists of: [ 134.166477][ T5329] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 134.166477][ T5329] [ 134.173115][ T5329] Possible unsafe locking scenario: [ 134.173115][ T5329] [ 134.176269][ T5329] CPU0 CPU1 [ 134.178561][ T5329] ---- ---- [ 134.180886][ T5329] lock(&mddev->reconfig_mutex); [ 134.183062][ T5329] lock((work_completion)(&mddev->sync_work)); [ 134.186639][ T5329] lock(&mddev->reconfig_mutex); [ 134.189661][ T5329] lock(major_names_lock); [ 134.191650][ T5329] [ 134.191650][ T5329] *** DEADLOCK *** [ 134.191650][ T5329] [ 134.195090][ T5329] locks held by syz.0.0/5329: 1, last CPU#0: [ 134.197692][ T5329] #0: ffff88804218c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 134.202206][ T5329] [ 134.202206][ T5329] stack backtrace: [ 134.204750][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 134.208707][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.212914][ T5329] Call Trace: [ 134.214451][ T5329] [ 134.215757][ T5329] dump_stack_lvl+0xe8/0x150 [ 134.217834][ T5329] print_circular_bug+0x2e2/0x300 [ 134.220220][ T5329] check_noncircular+0x12f/0x150 [ 134.222429][ T5329] __lock_acquire+0x164c/0x2de0 [ 134.224545][ T5329] ? post_alloc_hook+0x208/0x250 [ 134.226640][ T5329] ? get_page_from_freelist+0x2209/0x2280 [ 134.229046][ T5329] lock_acquire+0x115/0x350 [ 134.231018][ T5329] ? blk_request_module+0x35/0x2a0 [ 134.233244][ T5329] __mutex_lock+0x19d/0x1550 [ 134.235268][ T5329] ? blk_request_module+0x35/0x2a0 [ 134.237610][ T5329] ? lock_acquire+0x115/0x350 [ 134.239658][ T5329] ? blk_request_module+0x35/0x2a0 [ 134.241880][ T5329] ? __pfx___mutex_lock+0x10/0x10 [ 134.243924][ T5329] ? find_inode_fast+0x5dc/0x740 [ 134.245910][ T5329] ? find_inode_fast+0xd2/0x740 [ 134.247896][ T5329] blk_request_module+0x35/0x2a0 [ 134.249948][ T5329] blkdev_get_no_open+0x3f/0xe0 [ 134.252083][ T5329] bdev_file_open_by_dev+0xa0/0x240 [ 134.254285][ T5329] md_import_device+0x2e9/0x650 [ 134.256362][ T5329] md_add_new_disk+0x669/0x1850 [ 134.258527][ T5329] md_ioctl+0x1fe4/0x2610 [ 134.260402][ T5329] ? tomoyo_path_number_perm+0x219/0x5f0 [ 134.262869][ T5329] ? __pfx_md_ioctl+0x10/0x10 [ 134.264863][ T5329] ? do_vfs_ioctl+0x116f/0x1530 [ 134.266988][ T5329] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 134.269184][ T5329] ? hook_file_ioctl+0x1f2/0x600 [ 134.271284][ T5329] ? __pfx_md_ioctl+0x10/0x10 [ 134.273277][ T5329] blkdev_ioctl+0x5e3/0x740 [ 134.275231][ T5329] ? __pfx_blkdev_ioctl+0x10/0x10 [ 134.277368][ T5329] ? __fget_files+0x2a/0x420 [ 134.279422][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 134.281540][ T5329] ? __pfx_blkdev_ioctl+0x10/0x10 [ 134.283816][ T5329] __se_sys_ioctl+0xfc/0x170 [ 134.285865][ T5329] do_syscall_64+0x166/0x520 [ 134.287771][ T5329] ? trace_irq_disable+0x3b/0x140 [ 134.289981][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.292681][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 134.294768][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.297546][ T5329] RIP: 0033:0x7ff93279e159 [ 134.299502][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.307681][ T5329] RSP: 002b:00007ff9335eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.311344][ T5329] RAX: ffffffffffffffda RBX: 00007ff932a25fa0 RCX: 00007ff93279e159 [ 134.314675][ T5329] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000006 [ 134.318069][ T5329] RBP: 00007ff93283506b R08: 0000000000000000 R09: 0000000000000000 [ 134.321387][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.324655][ T5329] R13: 00007ff932a26038 R14: 00007ff932a25fa0 R15: 00007ffe92fd5408 [ 134.328020][ T5329] [ 134.333226][ T5335] md: md0: resync done. [ 134.384737][ T5329] md: could not open device unknown-block(0,0). [ 134.384778][ T5329] md: md_import_device returned -6