program: io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 85.673577][ T5282] Bluetooth: hci0: command tx timeout [ 85.776749][ T5325] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 85.781991][ T5326] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 85.782097][ T5326] block device autoloading is deprecated and will be removed. [ 85.844467][ T5325] md/raid10:md0: not clean -- starting background reconstruction [ 85.844482][ T5325] md/raid10:md0: active with 1 out of 2 devices [ 85.845825][ T5325] md0: detected capacity change from 0 to 2048 [ 85.874363][ T5329] md: resync of RAID array md0 [ 85.877085][ T5326] [ 85.879983][ T5326] ====================================================== [ 85.883125][ T5326] WARNING: possible circular locking dependency detected [ 85.886077][ T5326] syzkaller #0 Not tainted [ 85.887974][ T5326] ------------------------------------------------------ [ 85.890926][ T5326] syz.0.0/5326 is trying to acquire lock: [ 85.893204][ T5326] ffffffff8f556b80 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 85.897258][ T5326] [ 85.897258][ T5326] but task is already holding lock: [ 85.900298][ T5326] ffff88803172a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 85.904669][ T5326] [ 85.904669][ T5326] which lock already depends on the new lock. [ 85.904669][ T5326] [ 85.909209][ T5326] [ 85.909209][ T5326] the existing dependency chain (in reverse order) is: [ 85.913092][ T5326] [ 85.913092][ T5326] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 85.916684][ T5326] __mutex_lock+0x19d/0x1550 [ 85.918939][ T5326] md_start_sync+0x179/0x1010 [ 85.921251][ T5326] process_scheduled_works+0xc3d/0x1630 [ 85.923938][ T5326] worker_thread+0xa47/0xfb0 [ 85.926241][ T5326] kthread+0x38b/0x480 [ 85.928347][ T5326] ret_from_fork+0x514/0xb70 [ 85.930650][ T5326] ret_from_fork_asm+0x1a/0x30 [ 85.932980][ T5326] [ 85.932980][ T5326] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 85.937089][ T5326] process_scheduled_works+0xc03/0x1630 [ 85.939767][ T5326] worker_thread+0xa47/0xfb0 [ 85.942049][ T5326] kthread+0x38b/0x480 [ 85.944126][ T5326] ret_from_fork+0x514/0xb70 [ 85.946420][ T5326] ret_from_fork_asm+0x1a/0x30 [ 85.948774][ T5326] [ 85.948774][ T5326] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 85.952207][ T5326] touch_wq_lockdep_map+0xcb/0x180 [ 85.954580][ T5326] __flush_workqueue+0x148/0x1470 [ 85.956947][ T5326] md_alloc+0x32/0xf20 [ 85.958918][ T5326] md_alloc_and_put+0x1a/0x1f0 [ 85.961176][ T5326] blk_request_module+0x27d/0x2a0 [ 85.963629][ T5326] blkdev_get_no_open+0x3f/0xe0 [ 85.966062][ T5326] blkdev_open+0x1d7/0x600 [ 85.968305][ T5326] do_dentry_open+0x816/0x1380 [ 85.970656][ T5326] vfs_open+0x3b/0x340 [ 85.972629][ T5326] path_openat+0x1443/0x1d60 [ 85.974719][ T5326] do_file_open+0x23e/0x4a0 [ 85.976879][ T5326] do_sys_openat2+0x115/0x200 [ 85.979017][ T5326] __x64_sys_openat+0x138/0x170 [ 85.981211][ T5326] do_syscall_64+0x166/0x520 [ 85.983509][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.986372][ T5326] [ 85.986372][ T5326] -> #0 (major_names_lock){+.+.}-{4:4}: [ 85.989817][ T5326] __lock_acquire+0x164c/0x2de0 [ 85.992203][ T5326] lock_acquire+0x115/0x350 [ 85.994373][ T5326] __mutex_lock+0x19d/0x1550 [ 85.996645][ T5326] blk_request_module+0x35/0x2a0 [ 85.999065][ T5326] blkdev_get_no_open+0x3f/0xe0 [ 86.001419][ T5326] bdev_file_open_by_dev+0xa0/0x240 [ 86.003940][ T5326] md_import_device+0x2e9/0x650 [ 86.006387][ T5326] md_add_new_disk+0x669/0x1850 [ 86.008833][ T5326] md_ioctl+0x200a/0x2610 [ 86.010992][ T5326] blkdev_ioctl+0x5e3/0x740 [ 86.013238][ T5326] __se_sys_ioctl+0xfc/0x170 [ 86.015518][ T5326] do_syscall_64+0x166/0x520 [ 86.017818][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.020643][ T5326] [ 86.020643][ T5326] other info that might help us debug this: [ 86.020643][ T5326] [ 86.025081][ T5326] Chain exists of: [ 86.025081][ T5326] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 86.025081][ T5326] [ 86.031780][ T5326] Possible unsafe locking scenario: [ 86.031780][ T5326] [ 86.035014][ T5326] CPU0 CPU1 [ 86.037306][ T5326] ---- ---- [ 86.039643][ T5326] lock(&mddev->reconfig_mutex); [ 86.041859][ T5326] lock((work_completion)(&mddev->sync_work)); [ 86.045641][ T5326] lock(&mddev->reconfig_mutex); [ 86.048942][ T5326] lock(major_names_lock); [ 86.050932][ T5326] [ 86.050932][ T5326] *** DEADLOCK *** [ 86.050932][ T5326] [ 86.054422][ T5326] locks held by syz.0.0/5326: 1, last CPU#0: [ 86.057103][ T5326] #0: ffff88803172a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 86.061781][ T5326] [ 86.061781][ T5326] stack backtrace: [ 86.064428][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.068371][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.072815][ T5326] Call Trace: [ 86.074334][ T5326] [ 86.075672][ T5326] dump_stack_lvl+0xe8/0x150 [ 86.077846][ T5326] print_circular_bug+0x2e2/0x300 [ 86.080038][ T5326] check_noncircular+0x12f/0x150 [ 86.082160][ T5326] __lock_acquire+0x164c/0x2de0 [ 86.084215][ T5326] ? post_alloc_hook+0x208/0x250 [ 86.086478][ T5326] ? get_page_from_freelist+0x2209/0x2280 [ 86.088881][ T5326] lock_acquire+0x115/0x350 [ 86.090924][ T5326] ? blk_request_module+0x35/0x2a0 [ 86.093259][ T5326] __mutex_lock+0x19d/0x1550 [ 86.095341][ T5326] ? blk_request_module+0x35/0x2a0 [ 86.097794][ T5326] ? lock_acquire+0x115/0x350 [ 86.099949][ T5326] ? blk_request_module+0x35/0x2a0 [ 86.102271][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 86.104432][ T5326] ? find_inode_fast+0x5dc/0x740 [ 86.106493][ T5326] ? find_inode_fast+0xd2/0x740 [ 86.108682][ T5326] blk_request_module+0x35/0x2a0 [ 86.110668][ T5326] blkdev_get_no_open+0x3f/0xe0 [ 86.112682][ T5326] bdev_file_open_by_dev+0xa0/0x240 [ 86.114653][ T5326] md_import_device+0x2e9/0x650 [ 86.116677][ T5326] md_add_new_disk+0x669/0x1850 [ 86.118778][ T5326] md_ioctl+0x200a/0x2610 [ 86.120793][ T5326] ? tomoyo_path_number_perm+0x219/0x5f0 [ 86.123234][ T5326] ? __pfx_md_ioctl+0x10/0x10 [ 86.125394][ T5326] ? do_vfs_ioctl+0x116f/0x1530 [ 86.127522][ T5326] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 86.129941][ T5326] ? hook_file_ioctl+0x1f2/0x600 [ 86.132333][ T5326] ? __pfx_md_ioctl+0x10/0x10 [ 86.134448][ T5326] blkdev_ioctl+0x5e3/0x740 [ 86.136583][ T5326] ? __pfx_blkdev_ioctl+0x10/0x10 [ 86.138821][ T5326] ? __fget_files+0x2a/0x420 [ 86.140937][ T5326] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.143110][ T5326] ? __pfx_blkdev_ioctl+0x10/0x10 [ 86.145587][ T5326] __se_sys_ioctl+0xfc/0x170 [ 86.147804][ T5326] do_syscall_64+0x166/0x520 [ 86.150404][ T5326] ? trace_irq_disable+0x3b/0x140 [ 86.153263][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.156683][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 86.158913][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.161559][ T5326] RIP: 0033:0x7f708919e159 [ 86.163915][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.172017][ T5326] RSP: 002b:00007f70855f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.175718][ T5326] RAX: ffffffffffffffda RBX: 00007f7089426090 RCX: 00007f708919e159 [ 86.179700][ T5326] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 86.183843][ T5326] RBP: 00007f708923506b R08: 0000000000000000 R09: 0000000000000000 [ 86.187232][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.190669][ T5326] R13: 00007f7089426128 R14: 00007f7089426090 R15: 00007ffe620aecb8 [ 86.194449][ T5326] [ 86.223219][ T5329] md: md0: resync done. [ 86.242555][ T5326] block device autoloading is deprecated and will be removed. [ 86.243462][ T5330] md: recover of RAID array md0 [ 86.271795][ T5330] md: md0: recover done.