program: r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$md_new_array(r0, &(0x7f0000000040)={'md', @num=0x0}, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/md0\x00', 0x105042, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) write$md_new_array(r3, &(0x7f0000000440)={'md', @num=0x0}, 0x3) r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000480)={'/dev/md', @num=0x0}, 0x2, 0x0) ioctl$SET_ARRAY_INFO(r4, 0x40480923, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7fff, 0x5, 0x4d1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2000}) (async) ioctl$SET_ARRAY_INFO(r4, 0x40480923, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7fff, 0x5, 0x4d1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2000}) ioctl$ADD_NEW_DISK(r4, 0x40140921, &(0x7f0000000540)={0x6, {0x1, 0x1}, 0x0, 0x2e}) (async) ioctl$ADD_NEW_DISK(r4, 0x40140921, &(0x7f0000000540)={0x6, {0x1, 0x1}, 0x0, 0x2e}) ioctl$RUN_ARRAY(r4, 0x400c0930, 0x0) (async) ioctl$RUN_ARRAY(r4, 0x400c0930, 0x0) ioctl(r1, 0x40480923, &(0x7f00000002c0)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000340)="0000fe0000000000000000000010") (async) ioctl(r1, 0x40140921, &(0x7f0000000340)="0000fe0000000000000000000010") ioctl(r1, 0x400c0930, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES64=r0], 0x288}}, 0x20050800) (async) sendmsg$NFT_BATCH(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES64=r0], 0x288}}, 0x20050800) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) (async) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000600), r8) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="410000fff814000300060a0004090300f04db69b6dffff001007000700263a0909140002"], 0x44}, 0x1, 0x1000000}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="3c0d00005ead7e27e9233fc88bcc2d6fd4639488ef814166380c915bc5072dbc1aa80b2072da2976a31d14c0c4ae5ba089e75ba5f5408d49188ec232d6eb51e375e6a68b56af66fae3d65b4e3ce68dc7693e02eb020f2a2647e170ac2b35cc4a3cdd18514c831bc882f167bfe1ffffffffffffffffffdc06c8f885ba0b0c51f6a286805e6dab58e38470d9c82ad520fec57b13", @ANYRES16=r9, @ANYBLOB="010026bd7000fedbdf250700000014000300ff02000000000000000000000000000114000200ff020000000000000000000000000001"], 0x3c}, 0x1, 0x0, 0x0, 0x10044}, 0x4000004) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x200) madvise(&(0x7f0000f00000/0x2000)=nil, 0x2000, 0x17) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000003c0)={0x1, &(0x7f0000000380)=[{0x6, 0x3, 0x5, 0xfffffffa}]}) [ 102.611140][ T48] Bluetooth: hci0: command tx timeout [ 102.722036][ T5348] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.724684][ T5349] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.724833][ T5349] block device autoloading is deprecated and will be removed. [ 102.725963][ T5349] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.756448][ T5349] md: array md0 already has disks! [ 102.756631][ T5350] md: could not open device unknown-block(1,1). [ 102.756690][ T5350] md: error, md_import_device() returned -16 [ 102.799112][ T5350] md/raid:md0: not clean -- starting background reconstruction [ 102.800177][ T5350] md/raid:md0: device ram1 operational as raid disk 0 [ 102.835005][ T5350] md/raid:md0: cannot start dirty degraded array. [ 102.919129][ T5350] md/raid:md0: failed to run raid set. [ 102.919145][ T5350] md: pers->run() failed ... [ 102.949761][ T5349] md/raid:md0: not clean -- starting background reconstruction [ 102.949930][ T5349] md/raid:md0: device ram1 operational as raid disk 0 [ 102.985247][ T5349] md/raid:md0: cannot start dirty degraded array. [ 103.039805][ T5349] md/raid:md0: failed to run raid set. [ 103.039821][ T5349] md: pers->run() failed ... [ 103.039860][ T5348] md: array md0 already has disks! [ 103.039988][ T5353] [ 103.047732][ T5353] ====================================================== [ 103.050710][ T5353] WARNING: possible circular locking dependency detected [ 103.053498][ T5353] syzkaller #0 Not tainted [ 103.055418][ T5353] ------------------------------------------------------ [ 103.058762][ T5353] syz.0.0/5353 is trying to acquire lock: [ 103.062005][ T5353] ffffffff9096eba0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 103.066911][ T5353] [ 103.066911][ T5353] but task is already holding lock: [ 103.070162][ T5353] ffff8880383ac358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.074801][ T5353] [ 103.074801][ T5353] which lock already depends on the new lock. [ 103.074801][ T5353] [ 103.080097][ T5353] [ 103.080097][ T5353] the existing dependency chain (in reverse order) is: [ 103.085013][ T5353] [ 103.085013][ T5353] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 103.089245][ T5353] __mutex_lock+0x197/0x15a0 [ 103.091617][ T5353] md_alloc+0x81e/0xf40 [ 103.093742][ T5353] md_alloc_and_put+0x1a/0x1f0 [ 103.096077][ T5353] add_named_array+0x240/0x350 [ 103.098467][ T5353] param_attr_store+0x214/0x310 [ 103.100869][ T5353] module_attr_store+0x65/0x90 [ 103.103341][ T5353] kernfs_fop_write_iter+0x3a4/0x540 [ 103.106063][ T5353] vfs_write+0x612/0xba0 [ 103.108229][ T5353] ksys_write+0x150/0x270 [ 103.110464][ T5353] do_syscall_64+0x16a/0x530 [ 103.112823][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.115773][ T5353] [ 103.115773][ T5353] -> #1 (disks_mutex){+.+.}-{4:4}: [ 103.118584][ T5353] __mutex_lock+0x197/0x15a0 [ 103.120457][ T5353] md_alloc+0x40/0xf40 [ 103.122132][ T5353] md_alloc_and_put+0x1a/0x1f0 [ 103.123995][ T5353] blk_request_module+0x27d/0x2a0 [ 103.125989][ T5353] blkdev_get_no_open+0x3f/0xe0 [ 103.128027][ T5353] blkdev_open+0x1d7/0x600 [ 103.129960][ T5353] do_dentry_open+0x80e/0x1360 [ 103.132056][ T5353] vfs_open_consume+0x4a/0x350 [ 103.134122][ T5353] path_openat+0x16fc/0x20f0 [ 103.136380][ T5353] do_file_open+0x23e/0x4a0 [ 103.138700][ T5353] do_sys_openat2+0x115/0x200 [ 103.141042][ T5353] __x64_sys_openat+0x138/0x170 [ 103.143290][ T5353] do_syscall_64+0x16a/0x530 [ 103.145616][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.148495][ T5353] [ 103.148495][ T5353] -> #0 (major_names_lock){+.+.}-{4:4}: [ 103.152042][ T5353] __lock_acquire+0x164c/0x2de0 [ 103.154423][ T5353] lock_acquire+0x115/0x350 [ 103.156637][ T5353] __mutex_lock+0x197/0x15a0 [ 103.158963][ T5353] blk_request_module+0x35/0x2a0 [ 103.161305][ T5353] blkdev_get_no_open+0x3f/0xe0 [ 103.163569][ T5353] bdev_file_open_by_dev+0xa0/0x240 [ 103.165963][ T5353] md_import_device+0x2e9/0x650 [ 103.168294][ T5353] md_add_new_disk+0x522/0x1850 [ 103.170540][ T5353] md_ioctl+0x2027/0x2630 [ 103.172616][ T5353] blkdev_ioctl+0x5e3/0x740 [ 103.174756][ T5353] __se_sys_ioctl+0xfc/0x170 [ 103.176825][ T5353] do_syscall_64+0x16a/0x530 [ 103.179019][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.181925][ T5353] [ 103.181925][ T5353] other info that might help us debug this: [ 103.181925][ T5353] [ 103.186166][ T5353] Chain exists of: [ 103.186166][ T5353] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 103.186166][ T5353] [ 103.191535][ T5353] Possible unsafe locking scenario: [ 103.191535][ T5353] [ 103.194417][ T5353] CPU0 CPU1 [ 103.196594][ T5353] ---- ---- [ 103.198889][ T5353] lock(&mddev->reconfig_mutex); [ 103.200930][ T5353] lock(disks_mutex); [ 103.203906][ T5353] lock(&mddev->reconfig_mutex); [ 103.207160][ T5353] lock(major_names_lock); [ 103.209102][ T5353] [ 103.209102][ T5353] *** DEADLOCK *** [ 103.209102][ T5353] [ 103.212432][ T5353] locks held by syz.0.0/5353: 1, on CPU#0: [ 103.214929][ T5353] #0: ffff8880383ac358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.219106][ T5353] [ 103.219106][ T5353] stack backtrace: [ 103.222627][ T5353] CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.226603][ T5353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.230985][ T5353] Call Trace: [ 103.232483][ T5353] [ 103.233790][ T5353] dump_stack_lvl+0xe8/0x150 [ 103.235914][ T5353] print_circular_bug+0x2e2/0x300 [ 103.238228][ T5353] check_noncircular+0x12f/0x150 [ 103.240302][ T5353] __lock_acquire+0x164c/0x2de0 [ 103.242383][ T5353] ? post_alloc_hook+0x208/0x250 [ 103.244499][ T5353] ? get_page_from_freelist+0x2224/0x2290 [ 103.246826][ T5353] lock_acquire+0x115/0x350 [ 103.248450][ T5353] ? blk_request_module+0x35/0x2a0 [ 103.250305][ T5353] __mutex_lock+0x197/0x15a0 [ 103.252110][ T5353] ? blk_request_module+0x35/0x2a0 [ 103.254398][ T5353] ? lock_acquire+0x115/0x350 [ 103.256544][ T5353] ? blk_request_module+0x35/0x2a0 [ 103.258874][ T5353] ? __pfx___mutex_lock+0x10/0x10 [ 103.261146][ T5353] ? find_inode_fast+0x5dc/0x740 [ 103.263352][ T5353] ? find_inode_fast+0xd2/0x740 [ 103.265539][ T5353] blk_request_module+0x35/0x2a0 [ 103.267380][ T5353] blkdev_get_no_open+0x3f/0xe0 [ 103.269290][ T5353] bdev_file_open_by_dev+0xa0/0x240 [ 103.271402][ T5353] md_import_device+0x2e9/0x650 [ 103.273716][ T5353] md_add_new_disk+0x522/0x1850 [ 103.276003][ T5353] md_ioctl+0x2027/0x2630 [ 103.278102][ T5353] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.280676][ T5353] ? __pfx_md_ioctl+0x10/0x10 [ 103.282837][ T5353] ? do_vfs_ioctl+0x116f/0x1530 [ 103.285213][ T5353] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.287757][ T5353] ? do_futex+0x3e7/0x4e0 [ 103.289904][ T5353] ? __pfx_md_ioctl+0x10/0x10 [ 103.292188][ T5353] blkdev_ioctl+0x5e3/0x740 [ 103.294413][ T5353] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.296840][ T5353] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.299245][ T5353] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.301614][ T5353] __se_sys_ioctl+0xfc/0x170 [ 103.303796][ T5353] do_syscall_64+0x16a/0x530 [ 103.306068][ T5353] ? trace_irq_disable+0x3b/0x140 [ 103.308540][ T5353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.311304][ T5353] ? clear_bhb_loop+0x70/0xc0 [ 103.313516][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.316085][ T5353] RIP: 0033:0x7f1a4c39fb19 [ 103.318271][ T5353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.326467][ T5353] RSP: 002b:00007f1a4d1b3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.330153][ T5353] RAX: ffffffffffffffda RBX: 00007f1a4c626270 RCX: 00007f1a4c39fb19 [ 103.333614][ T5353] RDX: 0000200000000340 RSI: 0000000040140921 RDI: 0000000000000004 [ 103.337066][ T5353] RBP: 00007f1a4c437b70 R08: 0000000000000000 R09: 0000000000000000 [ 103.340593][ T5353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.344232][ T5353] R13: 00007f1a4c626308 R14: 00007f1a4c626270 R15: 00007fff45aa7a48 [ 103.347701][ T5353] [ 103.357391][ T25] audit: type=1326 audit(1794189293.266:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5347 comm="syz.0.0" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1a4c39fb19 code=0x0 [ 103.404637][ T5353] md: could not open device unknown-block(0,0). [ 103.404671][ T5353] md: error, md_import_device() returned -6 [ 103.445931][ T5354] md: could not open device unknown-block(0,0). [ 103.445953][ T5354] md: error, md_import_device() returned -6 [ 103.471521][ T5355] md/raid:md0: not clean -- starting background reconstruction [ 103.471648][ T5355] md/raid:md0: device ram1 operational as raid disk 0 [ 103.490348][ T5355] md/raid:md0: cannot start dirty degraded array. [ 103.546951][ T5355] md/raid:md0: failed to run raid set. [ 103.546967][ T5355] md: pers->run() failed ...