program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000001c0)=0x100000) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x928, 0x0) [ 95.703554][ T4645] Bluetooth: hci0: command tx timeout [ 95.888648][ T5316] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.889975][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.890052][ T5317] block device autoloading is deprecated and will be removed. [ 96.008480][ T5316] md/raid10:md0: not clean -- starting background reconstruction [ 96.008495][ T5316] md/raid10:md0: active with 1 out of 2 devices [ 96.011452][ T5316] md0: detected capacity change from 0 to 2048 [ 96.085255][ T5317] md: could not open device unknown-block(0,0). [ 96.085302][ T5317] md: error, md_import_device() returned -6 [ 96.087610][ T1969] [ 96.093922][ T1969] ====================================================== [ 96.096858][ T1969] WARNING: possible circular locking dependency detected [ 96.099808][ T1969] syzkaller #0 Not tainted [ 96.101727][ T1969] ------------------------------------------------------ [ 96.104604][ T1969] kworker/0:4/1969 is trying to acquire lock: [ 96.107042][ T1969] ffff888035742358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_start_sync+0x179/0x1010 [ 96.111419][ T1969] [ 96.111419][ T1969] but task is already holding lock: [ 96.114704][ T1969] ffffc90000b57c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 96.119853][ T1969] [ 96.119853][ T1969] which lock already depends on the new lock. [ 96.119853][ T1969] [ 96.124105][ T1969] [ 96.124105][ T1969] the existing dependency chain (in reverse order) is: [ 96.127446][ T1969] [ 96.127446][ T1969] -> #3 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 96.130768][ T1969] process_scheduled_works+0xc03/0x1630 [ 96.133067][ T1969] worker_thread+0xa47/0xfb0 [ 96.134954][ T1969] kthread+0x38b/0x480 [ 96.136590][ T1969] ret_from_fork+0x514/0xb70 [ 96.138419][ T1969] ret_from_fork_asm+0x1a/0x30 [ 96.140483][ T1969] [ 96.140483][ T1969] -> #2 ((wq_completion)md_misc){+.+.}-{0:0}: [ 96.143879][ T1969] touch_wq_lockdep_map+0xcb/0x180 [ 96.146298][ T1969] __flush_workqueue+0x148/0x1470 [ 96.148486][ T1969] md_alloc+0x32/0xf20 [ 96.150258][ T1969] md_alloc_and_put+0x1a/0x1f0 [ 96.152296][ T1969] blk_request_module+0x27d/0x2a0 [ 96.154431][ T1969] blkdev_get_no_open+0x3f/0xe0 [ 96.156422][ T1969] blkdev_open+0x1d7/0x600 [ 96.158224][ T1969] do_dentry_open+0x816/0x1380 [ 96.160534][ T1969] vfs_open+0x3b/0x340 [ 96.162399][ T1969] path_openat+0x1443/0x1d60 [ 96.164461][ T1969] do_file_open+0x23e/0x4a0 [ 96.166497][ T1969] do_sys_openat2+0x115/0x200 [ 96.168692][ T1969] __x64_sys_openat+0x138/0x170 [ 96.171051][ T1969] do_syscall_64+0x166/0x520 [ 96.173316][ T1969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.176097][ T1969] [ 96.176097][ T1969] -> #1 (major_names_lock){+.+.}-{4:4}: [ 96.179350][ T1969] __mutex_lock+0x19d/0x1550 [ 96.181465][ T1969] blk_request_module+0x35/0x2a0 [ 96.183589][ T1969] blkdev_get_no_open+0x3f/0xe0 [ 96.185699][ T1969] bdev_file_open_by_dev+0xa0/0x240 [ 96.188055][ T1969] md_import_device+0x2e9/0x650 [ 96.190210][ T1969] hot_add_disk+0xa7/0x4b0 [ 96.192162][ T1969] md_ioctl+0x1e5e/0x2610 [ 96.194145][ T1969] blkdev_ioctl+0x5e3/0x740 [ 96.196128][ T1969] __se_sys_ioctl+0xfc/0x170 [ 96.198167][ T1969] do_syscall_64+0x166/0x520 [ 96.200328][ T1969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.202726][ T1969] [ 96.202726][ T1969] -> #0 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 96.205989][ T1969] __lock_acquire+0x164c/0x2de0 [ 96.208306][ T1969] lock_acquire+0x115/0x350 [ 96.210478][ T1969] __mutex_lock+0x19d/0x1550 [ 96.212732][ T1969] md_start_sync+0x179/0x1010 [ 96.214794][ T1969] process_scheduled_works+0xc3d/0x1630 [ 96.217259][ T1969] worker_thread+0xa47/0xfb0 [ 96.219369][ T1969] kthread+0x38b/0x480 [ 96.221317][ T1969] ret_from_fork+0x514/0xb70 [ 96.223453][ T1969] ret_from_fork_asm+0x1a/0x30 [ 96.225609][ T1969] [ 96.225609][ T1969] other info that might help us debug this: [ 96.225609][ T1969] [ 96.229514][ T1969] Chain exists of: [ 96.229514][ T1969] &mddev->reconfig_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->sync_work) [ 96.229514][ T1969] [ 96.235949][ T1969] Possible unsafe locking scenario: [ 96.235949][ T1969] [ 96.238989][ T1969] CPU0 CPU1 [ 96.241273][ T1969] ---- ---- [ 96.243533][ T1969] lock((work_completion)(&mddev->sync_work)); [ 96.246270][ T1969] lock((wq_completion)md_misc); [ 96.249647][ T1969] lock((work_completion)(&mddev->sync_work)); [ 96.253340][ T1969] lock(&mddev->reconfig_mutex); [ 96.255607][ T1969] [ 96.255607][ T1969] *** DEADLOCK *** [ 96.255607][ T1969] [ 96.259141][ T1969] locks held by kworker/0:4/1969: 2, last CPU#0: [ 96.262104][ T1969] #0: ffff88803176a940 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 96.266523][ T1969] #1: ffffc90000b57c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 96.270795][ T1969] [ 96.270795][ T1969] stack backtrace: [ 96.272862][ T1969] CPU: 0 UID: 0 PID: 1969 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 96.276098][ T1969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.279754][ T1969] Workqueue: md_misc md_start_sync [ 96.281752][ T1969] Call Trace: [ 96.283120][ T1969] [ 96.284290][ T1969] dump_stack_lvl+0xe8/0x150 [ 96.286123][ T1969] print_circular_bug+0x2e2/0x300 [ 96.288191][ T1969] check_noncircular+0x12f/0x150 [ 96.290206][ T1969] __lock_acquire+0x164c/0x2de0 [ 96.292070][ T1969] ? unwind_next_frame+0x8f/0x2550 [ 96.293988][ T1969] ? unwind_next_frame+0x1baf/0x2550 [ 96.295873][ T1969] ? ret_from_fork_asm+0x1a/0x30 [ 96.297696][ T1969] ? unwind_next_frame+0x8f/0x2550 [ 96.299555][ T1969] lock_acquire+0x115/0x350 [ 96.301292][ T1969] ? md_start_sync+0x179/0x1010 [ 96.303047][ T1969] __mutex_lock+0x19d/0x1550 [ 96.304722][ T1969] ? md_start_sync+0x179/0x1010 [ 96.306515][ T1969] ? check_path+0x21/0x40 [ 96.308133][ T1969] ? md_start_sync+0x179/0x1010 [ 96.310131][ T1969] ? __pfx___mutex_lock+0x10/0x10 [ 96.312308][ T1969] ? md_spares_need_change+0x1c/0x240 [ 96.314668][ T1969] ? md_spares_need_change+0x1c/0x240 [ 96.316951][ T1969] md_start_sync+0x179/0x1010 [ 96.318945][ T1969] ? lock_acquire+0x115/0x350 [ 96.320929][ T1969] ? __pfx_md_start_sync+0x10/0x10 [ 96.323110][ T1969] ? rcu_is_watching+0x16/0xb0 [ 96.325062][ T1969] ? process_scheduled_works+0x97a/0x1630 [ 96.327418][ T1969] process_scheduled_works+0xc3d/0x1630 [ 96.329730][ T1969] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.332172][ T1969] ? assign_work+0x3cf/0x5d0 [ 96.334162][ T1969] worker_thread+0xa47/0xfb0 [ 96.336064][ T1969] ? __kthread_parkme+0x71/0x1f0 [ 96.338033][ T1969] kthread+0x38b/0x480 [ 96.339756][ T1969] ? __pfx_worker_thread+0x10/0x10 [ 96.341892][ T1969] ? __pfx_kthread+0x10/0x10 [ 96.343803][ T1969] ret_from_fork+0x514/0xb70 [ 96.345656][ T1969] ? __pfx_ret_from_fork+0x10/0x10 [ 96.347768][ T1969] ? __switch_to+0xc89/0x1420 [ 96.349764][ T1969] ? __pfx_kthread+0x10/0x10 [ 96.351784][ T1969] ret_from_fork_asm+0x1a/0x30 [ 96.353856][ T1969]