program: io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 90.656691][ T4649] Bluetooth: hci0: command tx timeout [ 90.673492][ T1241] cfg80211: failed to load regulatory.db [ 90.974599][ T5320] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 90.974719][ T5320] block device autoloading is deprecated and will be removed. [ 90.976133][ T5319] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 91.065209][ T5319] md/raid10:md0: not clean -- starting background reconstruction [ 91.065218][ T5319] md/raid10:md0: active with 1 out of 2 devices [ 91.066369][ T5319] md0: detected capacity change from 0 to 2048 [ 91.083186][ T5331] md: resync of RAID array md0 [ 91.088743][ T5320] [ 91.091788][ T5320] ====================================================== [ 91.094714][ T5320] WARNING: possible circular locking dependency detected [ 91.097340][ T5320] syzkaller #0 Not tainted [ 91.098987][ T5320] ------------------------------------------------------ [ 91.101888][ T5320] syz.0.0/5320 is trying to acquire lock: [ 91.104436][ T5320] ffffffff8f556b80 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 91.108759][ T5320] [ 91.108759][ T5320] but task is already holding lock: [ 91.111740][ T5320] ffff88801bb96358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 91.116083][ T5320] [ 91.116083][ T5320] which lock already depends on the new lock. [ 91.116083][ T5320] [ 91.120363][ T5320] [ 91.120363][ T5320] the existing dependency chain (in reverse order) is: [ 91.124202][ T5320] [ 91.124202][ T5320] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 91.127560][ T5320] __mutex_lock+0x19d/0x1550 [ 91.129742][ T5320] md_start_sync+0x179/0x1010 [ 91.131959][ T5320] process_scheduled_works+0xc3d/0x1630 [ 91.134399][ T5320] worker_thread+0xa47/0xfb0 [ 91.136395][ T5320] kthread+0x38b/0x480 [ 91.138325][ T5320] ret_from_fork+0x514/0xb70 [ 91.140400][ T5320] ret_from_fork_asm+0x1a/0x30 [ 91.142569][ T5320] [ 91.142569][ T5320] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 91.146452][ T5320] process_scheduled_works+0xc03/0x1630 [ 91.148981][ T5320] worker_thread+0xa47/0xfb0 [ 91.150999][ T5320] kthread+0x38b/0x480 [ 91.152903][ T5320] ret_from_fork+0x514/0xb70 [ 91.155103][ T5320] ret_from_fork_asm+0x1a/0x30 [ 91.157259][ T5320] [ 91.157259][ T5320] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 91.160678][ T5320] touch_wq_lockdep_map+0xcb/0x180 [ 91.163099][ T5320] __flush_workqueue+0x148/0x1470 [ 91.165435][ T5320] md_alloc+0x32/0xf20 [ 91.167592][ T5320] md_alloc_and_put+0x1a/0x1f0 [ 91.169885][ T5320] blk_request_module+0x27d/0x2a0 [ 91.172256][ T5320] blkdev_get_no_open+0x3f/0xe0 [ 91.174614][ T5320] blkdev_open+0x1d7/0x600 [ 91.176807][ T5320] do_dentry_open+0x816/0x1380 [ 91.179236][ T5320] vfs_open+0x3b/0x340 [ 91.181249][ T5320] path_openat+0x1443/0x1d60 [ 91.183727][ T5320] do_file_open+0x23e/0x4a0 [ 91.185946][ T5320] do_sys_openat2+0x115/0x200 [ 91.188229][ T5320] __x64_sys_openat+0x138/0x170 [ 91.190527][ T5320] do_syscall_64+0x166/0x520 [ 91.192786][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.195447][ T5320] [ 91.195447][ T5320] -> #0 (major_names_lock){+.+.}-{4:4}: [ 91.198726][ T5320] __lock_acquire+0x164c/0x2de0 [ 91.201167][ T5320] lock_acquire+0x115/0x350 [ 91.203227][ T5320] __mutex_lock+0x19d/0x1550 [ 91.205391][ T5320] blk_request_module+0x35/0x2a0 [ 91.207718][ T5320] blkdev_get_no_open+0x3f/0xe0 [ 91.210046][ T5320] bdev_file_open_by_dev+0xa0/0x240 [ 91.212496][ T5320] md_import_device+0x2e9/0x650 [ 91.214829][ T5320] md_add_new_disk+0x669/0x1850 [ 91.216958][ T5320] md_ioctl+0x200a/0x2610 [ 91.218873][ T5320] blkdev_ioctl+0x5e3/0x740 [ 91.221006][ T5320] __se_sys_ioctl+0xfc/0x170 [ 91.223146][ T5320] do_syscall_64+0x166/0x520 [ 91.225291][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.227787][ T5320] [ 91.227787][ T5320] other info that might help us debug this: [ 91.227787][ T5320] [ 91.232280][ T5320] Chain exists of: [ 91.232280][ T5320] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 91.232280][ T5320] [ 91.238840][ T5320] Possible unsafe locking scenario: [ 91.238840][ T5320] [ 91.242352][ T5320] CPU0 CPU1 [ 91.244740][ T5320] ---- ---- [ 91.246731][ T5320] lock(&mddev->reconfig_mutex); [ 91.248783][ T5320] lock((work_completion)(&mddev->sync_work)); [ 91.251935][ T5320] lock(&mddev->reconfig_mutex); [ 91.255024][ T5320] lock(major_names_lock); [ 91.256982][ T5320] [ 91.256982][ T5320] *** DEADLOCK *** [ 91.256982][ T5320] [ 91.260734][ T5320] locks held by syz.0.0/5320: 1, last CPU#0: [ 91.263940][ T5320] #0: ffff88801bb96358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 91.268437][ T5320] [ 91.268437][ T5320] stack backtrace: [ 91.271030][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 91.274701][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.278814][ T5320] Call Trace: [ 91.280341][ T5320] [ 91.281618][ T5320] dump_stack_lvl+0xe8/0x150 [ 91.283759][ T5320] print_circular_bug+0x2e2/0x300 [ 91.286020][ T5320] check_noncircular+0x12f/0x150 [ 91.288265][ T5320] __lock_acquire+0x164c/0x2de0 [ 91.290438][ T5320] ? post_alloc_hook+0x208/0x250 [ 91.292656][ T5320] ? get_page_from_freelist+0x2209/0x2280 [ 91.295055][ T5320] lock_acquire+0x115/0x350 [ 91.297055][ T5320] ? blk_request_module+0x35/0x2a0 [ 91.299301][ T5320] __mutex_lock+0x19d/0x1550 [ 91.301110][ T5320] ? blk_request_module+0x35/0x2a0 [ 91.303123][ T5320] ? lock_acquire+0x115/0x350 [ 91.305365][ T5320] ? blk_request_module+0x35/0x2a0 [ 91.307646][ T5320] ? __pfx___mutex_lock+0x10/0x10 [ 91.309906][ T5320] ? find_inode_fast+0x5dc/0x740 [ 91.312145][ T5320] ? find_inode_fast+0xd2/0x740 [ 91.314404][ T5320] blk_request_module+0x35/0x2a0 [ 91.316680][ T5320] blkdev_get_no_open+0x3f/0xe0 [ 91.318841][ T5320] bdev_file_open_by_dev+0xa0/0x240 [ 91.321176][ T5320] md_import_device+0x2e9/0x650 [ 91.323526][ T5320] md_add_new_disk+0x669/0x1850 [ 91.325918][ T5320] md_ioctl+0x200a/0x2610 [ 91.327884][ T5320] ? tomoyo_path_number_perm+0x219/0x5f0 [ 91.330328][ T5320] ? __pfx_md_ioctl+0x10/0x10 [ 91.332422][ T5320] ? do_vfs_ioctl+0x116f/0x1530 [ 91.334591][ T5320] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 91.336804][ T5320] ? hook_file_ioctl+0x1f2/0x600 [ 91.338859][ T5320] ? __pfx_md_ioctl+0x10/0x10 [ 91.340853][ T5320] blkdev_ioctl+0x5e3/0x740 [ 91.342762][ T5320] ? __pfx_blkdev_ioctl+0x10/0x10 [ 91.345036][ T5320] ? __fget_files+0x2a/0x420 [ 91.347126][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 91.349184][ T5320] ? __pfx_blkdev_ioctl+0x10/0x10 [ 91.351274][ T5320] __se_sys_ioctl+0xfc/0x170 [ 91.353364][ T5320] do_syscall_64+0x166/0x520 [ 91.355376][ T5320] ? trace_irq_disable+0x3b/0x140 [ 91.357547][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.360115][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 91.361968][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.364480][ T5320] RIP: 0033:0x7f278399e159 [ 91.366411][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.374451][ T5320] RSP: 002b:00007f27848ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 91.377929][ T5320] RAX: ffffffffffffffda RBX: 00007f2783c26090 RCX: 00007f278399e159 [ 91.381159][ T5320] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 91.384679][ T5320] RBP: 00007f2783a3506b R08: 0000000000000000 R09: 0000000000000000 [ 91.387997][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.391355][ T5320] R13: 00007f2783c26128 R14: 00007f2783c26090 R15: 00007ffcaf0a38e8 [ 91.395089][ T5320] [ 91.427735][ T5331] md: md0: resync done. [ 91.450053][ T5320] block device autoloading is deprecated and will be removed. [ 91.450941][ T5332] md: recover of RAID array md0 [ 91.470122][ T5332] md: md0: recover done.