program:
symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00')
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000440)='devtmpfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r1, &(0x7f00000004c0)='md0', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r2, 0x40480923, &(0x7f0000000540)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001")
ioctl(r2, 0x40140921, &(0x7f00000005c0)="0100000001000000010000000100000006")
ioctl(r2, 0x400c0930, 0x0)
ioctl(r2, 0x928, 0x0)
sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='7', 0x1)
ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f00000002c0)={'nr0\x00'})
mount$9p_virtio(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x8000, &(0x7f0000000180)={'trans=virtio,', {[{@posixacl}]}})
[ 101.738381][ T47] Bluetooth: hci0: command tx timeout
[ 101.914615][ T5321] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 101.914736][ T5321] block device autoloading is deprecated and will be removed.
[ 101.918198][ T5320] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 102.016784][ T5320] md/raid10:md0: not clean -- starting background reconstruction
[ 102.016801][ T5320] md/raid10:md0: active with 1 out of 2 devices
[ 102.019154][ T5320] md0: detected capacity change from 0 to 2048
[ 102.069638][ T5320] FAULT_INJECTION: forcing a failure.
[ 102.069638][ T5320] name failslab, interval 1, probability 0, space 0, times 1
[ 102.069664][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.069678][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.069695][ T5320] Call Trace:
[ 102.069711][ T5320]
[ 102.069717][ T5320] dump_stack_lvl+0xe8/0x150
[ 102.069785][ T5320] should_fail_ex+0x410/0x560
[ 102.069854][ T5320] should_failslab+0xa8/0x100
[ 102.069871][ T5320] __kmalloc_cache_noprof+0xa3/0x600
[ 102.069886][ T5320] ? call_usermodehelper_setup+0x8e/0x270
[ 102.069903][ T5320] ? call_usermodehelper_setup+0x8e/0x270
[ 102.069924][ T5320] ? __request_module+0x2ec/0x630
[ 102.069943][ T5320] call_usermodehelper_setup+0x8e/0x270
[ 102.069959][ T5320] ? __pfx_free_modprobe_argv+0x10/0x10
[ 102.069978][ T5320] __request_module+0x3ba/0x630
[ 102.070000][ T5320] ? __pfx___request_module+0x10/0x10
[ 102.070025][ T5320] ? bpf_lsm_capable+0x9/0x20
[ 102.070037][ T5320] ? security_capable+0x7e/0x2c0
[ 102.070057][ T5320] ? dev_load+0x21/0x1f0
[ 102.070115][ T5320] dev_load+0x190/0x1f0
[ 102.070135][ T5320] devinet_ioctl+0x126/0x1c50
[ 102.070168][ T5320] ? __pfx_devinet_ioctl+0x10/0x10
[ 102.070185][ T5320] ? get_user_ifreq+0x12b/0x180
[ 102.070213][ T5320] inet_ioctl+0x391/0x560
[ 102.070233][ T5320] ? __pfx_inet_ioctl+0x10/0x10
[ 102.070264][ T5320] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 102.070282][ T5320] sock_do_ioctl+0x101/0x320
[ 102.070299][ T5320] ? __pfx_sock_do_ioctl+0x10/0x10
[ 102.070312][ T5320] ? hook_file_ioctl+0x1f2/0x600
[ 102.070339][ T5320] sock_ioctl+0x57a/0x7e0
[ 102.070356][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 102.070371][ T5320] ? __fget_files+0x2a/0x420
[ 102.070388][ T5320] ? __fget_files+0x3a2/0x420
[ 102.070403][ T5320] ? __fget_files+0x2a/0x420
[ 102.070421][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 102.070436][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 102.070448][ T5320] __se_sys_ioctl+0xfc/0x170
[ 102.070464][ T5320] do_syscall_64+0x166/0x520
[ 102.070487][ T5320] ? trace_irq_disable+0x3b/0x140
[ 102.070498][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.070511][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 102.070527][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.070541][ T5320] RIP: 0033:0x7fbc99f9e1d9
[ 102.070556][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.070568][ T5320] RSP: 002b:00007fbc9af39fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 102.070584][ T5320] RAX: ffffffffffffffda RBX: 00007fbc9a225fa0 RCX: 00007fbc99f9e1d9
[ 102.070596][ T5320] RDX: 00002000000002c0 RSI: 0000000000008935 RDI: 0000000000000003
[ 102.070604][ T5320] RBP: 00007fbc9a035888 R08: 0000000000000000 R09: 0000000000000000
[ 102.070613][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.070620][ T5320] R13: 00007fbc9a226038 R14: 00007fbc9a225fa0 R15: 00007ffdeee98938
[ 102.070641][ T5320]
[ 102.519208][ T5321] md: could not open device unknown-block(0,0).
[ 102.519528][ T5321] md: error, md_import_device() returned -6
[ 102.528045][ T1150]
[ 102.529185][ T1150] ======================================================
[ 102.532191][ T1150] WARNING: possible circular locking dependency detected
[ 102.535433][ T1150] syzkaller #0 Not tainted
[ 102.537394][ T1150] ------------------------------------------------------
[ 102.540505][ T1150] kworker/0:3/1150 is trying to acquire lock:
[ 102.543131][ T1150] ffff888035716358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_start_sync+0x179/0x1010
[ 102.548094][ T1150]
[ 102.548094][ T1150] but task is already holding lock:
[ 102.551200][ T1150] ffffc90000e77c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 102.556237][ T1150]
[ 102.556237][ T1150] which lock already depends on the new lock.
[ 102.556237][ T1150]
[ 102.560396][ T1150]
[ 102.560396][ T1150] the existing dependency chain (in reverse order) is:
[ 102.564399][ T1150]
[ 102.564399][ T1150] -> #3 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}:
[ 102.568503][ T1150] process_scheduled_works+0xc03/0x1630
[ 102.571206][ T1150] worker_thread+0xa47/0xfb0
[ 102.573585][ T1150] kthread+0x38b/0x480
[ 102.575626][ T1150] ret_from_fork+0x514/0xb70
[ 102.577860][ T1150] ret_from_fork_asm+0x1a/0x30
[ 102.580152][ T1150]
[ 102.580152][ T1150] -> #2 ((wq_completion)md_misc){+.+.}-{0:0}:
[ 102.583627][ T1150] touch_wq_lockdep_map+0xcb/0x180
[ 102.586088][ T1150] __flush_workqueue+0x148/0x1470
[ 102.588497][ T1150] md_alloc+0x32/0xf20
[ 102.590425][ T1150] md_alloc_and_put+0x1a/0x1f0
[ 102.592667][ T1150] blk_request_module+0x27d/0x2a0
[ 102.595932][ T1150] blkdev_get_no_open+0x3f/0xe0
[ 102.598282][ T1150] blkdev_open+0x1d7/0x600
[ 102.600171][ T1150] do_dentry_open+0x816/0x1380
[ 102.602335][ T1150] vfs_open+0x3b/0x340
[ 102.604228][ T1150] path_openat+0x1443/0x1d60
[ 102.606253][ T1150] do_file_open+0x23e/0x4a0
[ 102.608317][ T1150] do_sys_openat2+0x115/0x200
[ 102.610418][ T1150] __x64_sys_openat+0x138/0x170
[ 102.612668][ T1150] do_syscall_64+0x166/0x520
[ 102.614742][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.617183][ T1150]
[ 102.617183][ T1150] -> #1 (major_names_lock){+.+.}-{4:4}:
[ 102.620408][ T1150] __mutex_lock+0x19d/0x1550
[ 102.622624][ T1150] blk_request_module+0x35/0x2a0
[ 102.625039][ T1150] blkdev_get_no_open+0x3f/0xe0
[ 102.627418][ T1150] bdev_file_open_by_dev+0xa0/0x240
[ 102.629886][ T1150] md_import_device+0x2e9/0x650
[ 102.632095][ T1150] hot_add_disk+0xa7/0x4b0
[ 102.634124][ T1150] md_ioctl+0x1e5e/0x2610
[ 102.636110][ T1150] blkdev_ioctl+0x5e3/0x740
[ 102.638153][ T1150] __se_sys_ioctl+0xfc/0x170
[ 102.640236][ T1150] do_syscall_64+0x166/0x520
[ 102.642320][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.644979][ T1150]
[ 102.644979][ T1150] -> #0 (&mddev->reconfig_mutex){+.+.}-{4:4}:
[ 102.648785][ T1150] __lock_acquire+0x164c/0x2de0
[ 102.651270][ T1150] lock_acquire+0x115/0x350
[ 102.653586][ T1150] __mutex_lock+0x19d/0x1550
[ 102.655951][ T1150] md_start_sync+0x179/0x1010
[ 102.658277][ T1150] process_scheduled_works+0xc3d/0x1630
[ 102.660882][ T1150] worker_thread+0xa47/0xfb0
[ 102.663057][ T1150] kthread+0x38b/0x480
[ 102.665054][ T1150] ret_from_fork+0x514/0xb70
[ 102.667217][ T1150] ret_from_fork_asm+0x1a/0x30
[ 102.669476][ T1150]
[ 102.669476][ T1150] other info that might help us debug this:
[ 102.669476][ T1150]
[ 102.673625][ T1150] Chain exists of:
[ 102.673625][ T1150] &mddev->reconfig_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->sync_work)
[ 102.673625][ T1150]
[ 102.680048][ T1150] Possible unsafe locking scenario:
[ 102.680048][ T1150]
[ 102.683134][ T1150] CPU0 CPU1
[ 102.685483][ T1150] ---- ----
[ 102.687759][ T1150] lock((work_completion)(&mddev->sync_work));
[ 102.690339][ T1150] lock((wq_completion)md_misc);
[ 102.693295][ T1150] lock((work_completion)(&mddev->sync_work));
[ 102.696989][ T1150] lock(&mddev->reconfig_mutex);
[ 102.699141][ T1150]
[ 102.699141][ T1150] *** DEADLOCK ***
[ 102.699141][ T1150]
[ 102.702585][ T1150] locks held by kworker/0:3/1150: 2, last CPU#0:
[ 102.705371][ T1150] #0: ffff888030aa5940 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 102.710165][ T1150] #1: ffffc90000e77c40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 102.715375][ T1150]
[ 102.715375][ T1150] stack backtrace:
[ 102.717987][ T1150] CPU: 0 UID: 0 PID: 1150 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 102.722120][ T1150] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.726373][ T1150] Workqueue: md_misc md_start_sync
[ 102.735129][ T1150] Call Trace:
[ 102.737733][ T1150]
[ 102.739105][ T1150] dump_stack_lvl+0xe8/0x150
[ 102.741183][ T1150] print_circular_bug+0x2e2/0x300
[ 102.743457][ T1150] check_noncircular+0x12f/0x150
[ 102.745676][ T1150] __lock_acquire+0x164c/0x2de0
[ 102.747779][ T1150] ? unwind_next_frame+0x8f/0x2550
[ 102.750058][ T1150] ? unwind_next_frame+0x1baf/0x2550
[ 102.752417][ T1150] ? ret_from_fork_asm+0x1a/0x30
[ 102.754619][ T1150] ? unwind_next_frame+0x8f/0x2550
[ 102.756890][ T1150] lock_acquire+0x115/0x350
[ 102.759141][ T1150] ? md_start_sync+0x179/0x1010
[ 102.761482][ T1150] __mutex_lock+0x19d/0x1550
[ 102.764403][ T1150] ? md_start_sync+0x179/0x1010
[ 102.766500][ T1150] ? check_path+0x21/0x40
[ 102.768314][ T1150] ? md_start_sync+0x179/0x1010
[ 102.770311][ T1150] ? __pfx___mutex_lock+0x10/0x10
[ 102.772315][ T1150] ? md_spares_need_change+0x1c/0x240
[ 102.774499][ T1150] ? md_spares_need_change+0x1c/0x240
[ 102.776673][ T1150] md_start_sync+0x179/0x1010
[ 102.779949][ T1150] ? lock_acquire+0x115/0x350
[ 102.781888][ T1150] ? __pfx_md_start_sync+0x10/0x10
[ 102.784053][ T1150] ? rcu_is_watching+0x16/0xb0
[ 102.786080][ T1150] ? process_scheduled_works+0x97a/0x1630
[ 102.788553][ T1150] process_scheduled_works+0xc3d/0x1630
[ 102.790966][ T1150] ? __pfx_process_scheduled_works+0x10/0x10
[ 102.793356][ T1150] ? assign_work+0x3cf/0x5d0
[ 102.795241][ T1150] worker_thread+0xa47/0xfb0
[ 102.797137][ T1150] ? __kthread_parkme+0x71/0x1f0
[ 102.799554][ T1150] kthread+0x38b/0x480
[ 102.801444][ T1150] ? __pfx_worker_thread+0x10/0x10
[ 102.803645][ T1150] ? __pfx_kthread+0x10/0x10
[ 102.805588][ T1150] ret_from_fork+0x514/0xb70
[ 102.807564][ T1150] ? __pfx_ret_from_fork+0x10/0x10
[ 102.809655][ T1150] ? __switch_to+0xc89/0x1420
[ 102.811583][ T1150] ? __pfx_kthread+0x10/0x10
[ 102.813492][ T1150] ret_from_fork_asm+0x1a/0x30
[ 102.815510][ T1150]