program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', 0x0, 0x2800005, 0x0) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="02c8"], 0x15) ioctl(r1, 0x40140921, &(0x7f0000000440)) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) [ 102.384443][ T46] Bluetooth: hci0: command tx timeout [ 102.498501][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.502349][ T5325] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.502471][ T5325] block device autoloading is deprecated and will be removed. [ 102.735490][ T5324] md/raid10:md0: not clean -- starting background reconstruction [ 102.735506][ T5324] md/raid10:md0: active with 1 out of 2 devices [ 102.737251][ T5324] md0: detected capacity change from 0 to 2048 [ 102.781124][ T5330] md: resync of RAID array md0 [ 102.837529][ T46] Bluetooth: Frame is too long (len 16, expected len 4) [ 102.856752][ T5330] md: md0: resync done. [ 102.861612][ T5324] [ 102.862603][ T5324] ====================================================== [ 102.865335][ T5324] WARNING: possible circular locking dependency detected [ 102.868337][ T5324] syzkaller #0 Not tainted [ 102.870286][ T5324] ------------------------------------------------------ [ 102.873342][ T5324] syz.0.0/5324 is trying to acquire lock: [ 102.876163][ T5324] ffffffff8f5563c0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 102.880731][ T5324] [ 102.880731][ T5324] but task is already holding lock: [ 102.883703][ T5324] ffff888034062358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 102.887839][ T5324] [ 102.887839][ T5324] which lock already depends on the new lock. [ 102.887839][ T5324] [ 102.891897][ T5324] [ 102.891897][ T5324] the existing dependency chain (in reverse order) is: [ 102.895547][ T5324] [ 102.895547][ T5324] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 102.899055][ T5324] __mutex_lock+0x19d/0x1550 [ 102.901345][ T5324] md_start_sync+0x179/0x1010 [ 102.903518][ T5324] process_scheduled_works+0xc3d/0x1630 [ 102.906035][ T5324] worker_thread+0xa47/0xfb0 [ 102.908106][ T5324] kthread+0x38b/0x480 [ 102.909952][ T5324] ret_from_fork+0x514/0xb70 [ 102.912146][ T5324] ret_from_fork_asm+0x1a/0x30 [ 102.914617][ T5324] [ 102.914617][ T5324] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 102.918808][ T5324] process_scheduled_works+0xc03/0x1630 [ 102.921392][ T5324] worker_thread+0xa47/0xfb0 [ 102.923632][ T5324] kthread+0x38b/0x480 [ 102.925749][ T5324] ret_from_fork+0x514/0xb70 [ 102.927904][ T5324] ret_from_fork_asm+0x1a/0x30 [ 102.930202][ T5324] [ 102.930202][ T5324] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 102.933747][ T5324] touch_wq_lockdep_map+0xcb/0x180 [ 102.936214][ T5324] __flush_workqueue+0x148/0x1470 [ 102.938611][ T5324] md_alloc+0x32/0xf20 [ 102.940694][ T5324] md_alloc_and_put+0x1a/0x1f0 [ 102.943026][ T5324] blk_request_module+0x27d/0x2a0 [ 102.945512][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 102.947955][ T5324] blkdev_open+0x1d7/0x600 [ 102.950288][ T5324] do_dentry_open+0x816/0x1380 [ 102.952687][ T5324] vfs_open+0x3b/0x340 [ 102.954793][ T5324] path_openat+0x1443/0x1d60 [ 102.957040][ T5324] do_file_open+0x23e/0x4a0 [ 102.959258][ T5324] do_sys_openat2+0x115/0x200 [ 102.961544][ T5324] __x64_sys_openat+0x138/0x170 [ 102.963898][ T5324] do_syscall_64+0x166/0x520 [ 102.966093][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.968951][ T5324] [ 102.968951][ T5324] -> #0 (major_names_lock){+.+.}-{4:4}: [ 102.972334][ T5324] __lock_acquire+0x164c/0x2de0 [ 102.974663][ T5324] lock_acquire+0x115/0x350 [ 102.976978][ T5324] __mutex_lock+0x19d/0x1550 [ 102.979273][ T5324] blk_request_module+0x35/0x2a0 [ 102.981594][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 102.983869][ T5324] bdev_file_open_by_dev+0xa0/0x240 [ 102.986293][ T5324] md_import_device+0x2e9/0x650 [ 102.988598][ T5324] md_add_new_disk+0x669/0x1850 [ 102.990874][ T5324] md_ioctl+0x200a/0x2610 [ 102.992567][ T5324] blkdev_ioctl+0x5e3/0x740 [ 102.994634][ T5324] __se_sys_ioctl+0xfc/0x170 [ 102.996973][ T5324] do_syscall_64+0x166/0x520 [ 102.999217][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.001465][ T5324] [ 103.001465][ T5324] other info that might help us debug this: [ 103.001465][ T5324] [ 103.004979][ T5324] Chain exists of: [ 103.004979][ T5324] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 103.004979][ T5324] [ 103.011062][ T5324] Possible unsafe locking scenario: [ 103.011062][ T5324] [ 103.013962][ T5324] CPU0 CPU1 [ 103.016099][ T5324] ---- ---- [ 103.018266][ T5324] lock(&mddev->reconfig_mutex); [ 103.020273][ T5324] lock((work_completion)(&mddev->sync_work)); [ 103.023774][ T5324] lock(&mddev->reconfig_mutex); [ 103.026721][ T5324] lock(major_names_lock); [ 103.028621][ T5324] [ 103.028621][ T5324] *** DEADLOCK *** [ 103.028621][ T5324] [ 103.032002][ T5324] locks held by syz.0.0/5324: 1, last CPU#0: [ 103.034494][ T5324] #0: ffff888034062358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.038928][ T5324] [ 103.038928][ T5324] stack backtrace: [ 103.041430][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.045215][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.049182][ T5324] Call Trace: [ 103.050446][ T5324] [ 103.051663][ T5324] dump_stack_lvl+0xe8/0x150 [ 103.053620][ T5324] print_circular_bug+0x2e2/0x300 [ 103.055657][ T5324] check_noncircular+0x12f/0x150 [ 103.057732][ T5324] __lock_acquire+0x164c/0x2de0 [ 103.059589][ T5324] ? post_alloc_hook+0x208/0x250 [ 103.061359][ T5324] ? get_page_from_freelist+0x2209/0x2280 [ 103.063449][ T5324] lock_acquire+0x115/0x350 [ 103.065192][ T5324] ? blk_request_module+0x35/0x2a0 [ 103.067222][ T5324] __mutex_lock+0x19d/0x1550 [ 103.069256][ T5324] ? blk_request_module+0x35/0x2a0 [ 103.071408][ T5324] ? lock_acquire+0x115/0x350 [ 103.073460][ T5324] ? blk_request_module+0x35/0x2a0 [ 103.075705][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 103.077838][ T5324] ? find_inode_fast+0x5dc/0x740 [ 103.079772][ T5324] ? find_inode_fast+0xd2/0x740 [ 103.081876][ T5324] blk_request_module+0x35/0x2a0 [ 103.083936][ T5324] blkdev_get_no_open+0x3f/0xe0 [ 103.085979][ T5324] bdev_file_open_by_dev+0xa0/0x240 [ 103.088162][ T5324] md_import_device+0x2e9/0x650 [ 103.090188][ T5324] md_add_new_disk+0x669/0x1850 [ 103.092262][ T5324] md_ioctl+0x200a/0x2610 [ 103.094077][ T5324] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.096381][ T5324] ? __pfx_md_ioctl+0x10/0x10 [ 103.098421][ T5324] ? do_vfs_ioctl+0x116f/0x1530 [ 103.100275][ T5324] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.102175][ T5324] ? vfs_write+0x9d5/0xba0 [ 103.104133][ T5324] ? hook_file_ioctl+0x1f2/0x600 [ 103.106051][ T5324] ? __pfx_md_ioctl+0x10/0x10 [ 103.108107][ T5324] blkdev_ioctl+0x5e3/0x740 [ 103.110038][ T5324] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.112212][ T5324] ? __fget_files+0x2a/0x420 [ 103.114235][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.116369][ T5324] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.118580][ T5324] __se_sys_ioctl+0xfc/0x170 [ 103.120629][ T5324] do_syscall_64+0x166/0x520 [ 103.122681][ T5324] ? trace_irq_disable+0x3b/0x140 [ 103.124913][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.127564][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 103.129639][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.132109][ T5324] RIP: 0033:0x7f594279e159 [ 103.134015][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.141831][ T5324] RSP: 002b:00007f59435a9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.145124][ T5324] RAX: ffffffffffffffda RBX: 00007f5942a25fa0 RCX: 00007f594279e159 [ 103.148119][ T5324] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 103.151093][ T5324] RBP: 00007f594283506b R08: 0000000000000000 R09: 0000000000000000 [ 103.154221][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.157448][ T5324] R13: 00007f5942a26038 R14: 00007f5942a25fa0 R15: 00007ffe0f6ea618 [ 103.160313][ T5324] [ 103.216089][ T5324] md: could not open device unknown-block(0,0). [ 103.216131][ T5324] md: md_import_device returned -6