program: socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x14, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x48) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x4000, &(0x7f0000000600)={[{@init_itable_val={'init_itable', 0x3d, 0x619}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x84}}, {@delalloc}, {@commit={'commit', 0x3d, 0x5}}, {@orlov}, {@barrier_val={'barrier', 0x3d, 0x5}}, {@max_batch_time}, {@data_err_abort}]}, 0xd, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r1, &(0x7f0000000140), 0x0}, 0x20) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000100)=0x1) ioctl$VIDIOC_CROPCAP(r2, 0xc02c563a, &(0x7f0000000080)={0x2, {0x80000000, 0x5, 0x2dd, 0x28}, {0x1, 0x1, 0x7, 0xfffffffc}, {0x4860, 0x2}}) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000640)={'dummy0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000380)='%pi6 \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{r6}, &(0x7f0000000540), &(0x7f0000000580)='%-010d \x00'}, 0x20) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@generic={&(0x7f0000000400)='./file0\x00', 0x0, 0x10}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000100000000000000dc000000017503000200fcff9500000000000000"], &(0x7f0000000100)='GPL\x00', 0xcec, 0x1f, &(0x7f0000000180)=""/31, 0x41100, 0x3c, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x7, 0xeb23, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000500)=[r6, 0x1, r7], 0x0, 0x10, 0xfffffffd}, 0x94) io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r8, &(0x7f0000000200)='md0', 0x3) r9 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r9, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r9, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r9, 0x400c0930, 0x0) ioctl(r9, 0x40140921, &(0x7f0000000440)="020000000100") [ 94.041104][ T5281] Bluetooth: hci0: command tx timeout [ 94.183243][ T5317] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.187512][ T5317] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.238602][ T5318] loop0: detected capacity change from 0 to 1024 [ 94.256017][ T5318] EXT4-fs: Ignoring removed orlov option [ 94.279173][ T5318] EXT4-fs (loop0): can't mount with data_err=abort, fs mounted w/o journal [ 94.433339][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.437354][ T5318] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.437449][ T5318] block device autoloading is deprecated and will be removed. [ 94.524676][ T5317] md/raid10:md0: not clean -- starting background reconstruction [ 94.524692][ T5317] md/raid10:md0: active with 1 out of 2 devices [ 94.526767][ T5317] md0: detected capacity change from 0 to 2048 [ 94.561735][ T5322] md: resync of RAID array md0 [ 94.572746][ T5318] [ 94.574221][ T5318] ====================================================== [ 94.577147][ T5318] WARNING: possible circular locking dependency detected [ 94.580019][ T5318] syzkaller #0 Not tainted [ 94.581906][ T5318] ------------------------------------------------------ [ 94.584837][ T5318] syz.0.0/5318 is trying to acquire lock: [ 94.587402][ T5318] ffffffff8f5563c0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 94.591333][ T5318] [ 94.591333][ T5318] but task is already holding lock: [ 94.594529][ T5318] ffff88803557e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 94.599286][ T5318] [ 94.599286][ T5318] which lock already depends on the new lock. [ 94.599286][ T5318] [ 94.603523][ T5318] [ 94.603523][ T5318] the existing dependency chain (in reverse order) is: [ 94.607223][ T5318] [ 94.607223][ T5318] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 94.610427][ T5318] __mutex_lock+0x19d/0x1550 [ 94.612512][ T5318] md_start_sync+0x179/0x1010 [ 94.614843][ T5318] process_scheduled_works+0xc3d/0x1630 [ 94.617629][ T5318] worker_thread+0xa47/0xfb0 [ 94.619953][ T5318] kthread+0x38b/0x480 [ 94.621763][ T5318] ret_from_fork+0x514/0xb70 [ 94.623804][ T5318] ret_from_fork_asm+0x1a/0x30 [ 94.625950][ T5318] [ 94.625950][ T5318] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 94.629986][ T5318] process_scheduled_works+0xc03/0x1630 [ 94.632626][ T5318] worker_thread+0xa47/0xfb0 [ 94.635003][ T5318] kthread+0x38b/0x480 [ 94.637287][ T5318] ret_from_fork+0x514/0xb70 [ 94.639857][ T5318] ret_from_fork_asm+0x1a/0x30 [ 94.642403][ T5318] [ 94.642403][ T5318] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 94.646256][ T5318] touch_wq_lockdep_map+0xcb/0x180 [ 94.648612][ T5318] __flush_workqueue+0x148/0x1470 [ 94.651043][ T5318] md_alloc+0x32/0xf20 [ 94.653282][ T5318] md_alloc_and_put+0x1a/0x1f0 [ 94.656054][ T5318] blk_request_module+0x27d/0x2a0 [ 94.658814][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 94.661142][ T5318] blkdev_open+0x1d7/0x600 [ 94.667331][ T5318] do_dentry_open+0x816/0x1380 [ 94.669457][ T5318] vfs_open+0x3b/0x340 [ 94.671150][ T5318] path_openat+0x1443/0x1d60 [ 94.673198][ T5318] do_file_open+0x23e/0x4a0 [ 94.675461][ T5318] do_sys_openat2+0x115/0x200 [ 94.678168][ T5318] __x64_sys_openat+0x138/0x170 [ 94.680967][ T5318] do_syscall_64+0x166/0x520 [ 94.683695][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.686626][ T5318] [ 94.686626][ T5318] -> #0 (major_names_lock){+.+.}-{4:4}: [ 94.690131][ T5318] __lock_acquire+0x164c/0x2de0 [ 94.692598][ T5318] lock_acquire+0x115/0x350 [ 94.694885][ T5318] __mutex_lock+0x19d/0x1550 [ 94.697123][ T5318] blk_request_module+0x35/0x2a0 [ 94.699480][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 94.701924][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 94.704473][ T5318] md_import_device+0x2e9/0x650 [ 94.706820][ T5318] md_add_new_disk+0x669/0x1850 [ 94.709218][ T5318] md_ioctl+0x200a/0x2610 [ 94.711182][ T5318] blkdev_ioctl+0x5e3/0x740 [ 94.713327][ T5318] __se_sys_ioctl+0xfc/0x170 [ 94.715561][ T5318] do_syscall_64+0x166/0x520 [ 94.717921][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.720682][ T5318] [ 94.720682][ T5318] other info that might help us debug this: [ 94.720682][ T5318] [ 94.724805][ T5318] Chain exists of: [ 94.724805][ T5318] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 94.724805][ T5318] [ 94.730984][ T5318] Possible unsafe locking scenario: [ 94.730984][ T5318] [ 94.734503][ T5318] CPU0 CPU1 [ 94.737415][ T5318] ---- ---- [ 94.740067][ T5318] lock(&mddev->reconfig_mutex); [ 94.742272][ T5318] lock((work_completion)(&mddev->sync_work)); [ 94.746108][ T5318] lock(&mddev->reconfig_mutex); [ 94.749293][ T5318] lock(major_names_lock); [ 94.751206][ T5318] [ 94.751206][ T5318] *** DEADLOCK *** [ 94.751206][ T5318] [ 94.754744][ T5318] locks held by syz.0.0/5318: 1, last CPU#0: [ 94.757660][ T5318] #0: ffff88803557e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 94.763170][ T5318] [ 94.763170][ T5318] stack backtrace: [ 94.765718][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.769668][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.774096][ T5318] Call Trace: [ 94.775661][ T5318] [ 94.777135][ T5318] dump_stack_lvl+0xe8/0x150 [ 94.779372][ T5318] print_circular_bug+0x2e2/0x300 [ 94.781560][ T5318] check_noncircular+0x12f/0x150 [ 94.784046][ T5318] __lock_acquire+0x164c/0x2de0 [ 94.785738][ T5318] ? post_alloc_hook+0x208/0x250 [ 94.787557][ T5318] ? get_page_from_freelist+0x2209/0x2280 [ 94.789612][ T5318] lock_acquire+0x115/0x350 [ 94.791168][ T5318] ? blk_request_module+0x35/0x2a0 [ 94.792989][ T5318] __mutex_lock+0x19d/0x1550 [ 94.794701][ T5318] ? blk_request_module+0x35/0x2a0 [ 94.796510][ T5318] ? lock_acquire+0x115/0x350 [ 94.798771][ T5318] ? blk_request_module+0x35/0x2a0 [ 94.801078][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 94.803331][ T5318] ? find_inode_fast+0x5dc/0x740 [ 94.805539][ T5318] ? find_inode_fast+0xd2/0x740 [ 94.807763][ T5318] blk_request_module+0x35/0x2a0 [ 94.810037][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 94.812280][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 94.814908][ T5318] md_import_device+0x2e9/0x650 [ 94.817471][ T5318] md_add_new_disk+0x669/0x1850 [ 94.819827][ T5318] md_ioctl+0x200a/0x2610 [ 94.821779][ T5318] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.824100][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 94.826025][ T5318] ? do_vfs_ioctl+0x116f/0x1530 [ 94.828276][ T5318] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.830864][ T5318] ? hook_file_ioctl+0x1f2/0x600 [ 94.833661][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 94.836215][ T5318] blkdev_ioctl+0x5e3/0x740 [ 94.838166][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.840427][ T5318] ? __fget_files+0x2a/0x420 [ 94.842542][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.844775][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.847125][ T5318] __se_sys_ioctl+0xfc/0x170 [ 94.849371][ T5318] do_syscall_64+0x166/0x520 [ 94.851625][ T5318] ? trace_irq_disable+0x3b/0x140 [ 94.854008][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.857572][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 94.860739][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.863461][ T5318] RIP: 0033:0x7fa16099e159 [ 94.865405][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.873758][ T5318] RSP: 002b:00007fa16179ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.878176][ T5318] RAX: ffffffffffffffda RBX: 00007fa160c26090 RCX: 00007fa16099e159 [ 94.881761][ T5318] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 000000000000000a [ 94.885304][ T5318] RBP: 00007fa160a3506b R08: 0000000000000000 R09: 0000000000000000 [ 94.889040][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.893475][ T5318] R13: 00007fa160c26128 R14: 00007fa160c26090 R15: 00007ffc7f8b9c28 [ 94.897242][ T5318] [ 94.906888][ T5322] md: md0: resync done. [ 94.925350][ T5318] block device autoloading is deprecated and will be removed. [ 94.928432][ T5323] md: recover of RAID array md0 [ 94.958928][ T5323] md: md0: recover done.