program: io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 101.681941][ T46] Bluetooth: hci0: command tx timeout [ 101.835455][ T5327] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 101.844882][ T5328] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 101.845040][ T5328] block device autoloading is deprecated and will be removed. [ 101.931986][ T5327] md/raid10:md0: not clean -- starting background reconstruction [ 101.932002][ T5327] md/raid10:md0: active with 1 out of 2 devices [ 101.932788][ T5327] md0: detected capacity change from 0 to 2048 [ 101.957815][ T5328] [ 101.959020][ T5328] ====================================================== [ 101.962090][ T5328] WARNING: possible circular locking dependency detected [ 101.965271][ T5328] syzkaller #0 Not tainted [ 101.967275][ T5328] ------------------------------------------------------ [ 101.970389][ T5328] syz.0.0/5328 is trying to acquire lock: [ 101.972993][ T5328] ffffffff8f556ae0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 101.977238][ T5328] [ 101.977238][ T5328] but task is already holding lock: [ 101.980540][ T5328] ffff88803790a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 101.985170][ T5328] [ 101.985170][ T5328] which lock already depends on the new lock. [ 101.985170][ T5328] [ 101.989785][ T5328] [ 101.989785][ T5328] the existing dependency chain (in reverse order) is: [ 101.993753][ T5328] [ 101.993753][ T5328] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 102.000697][ T5328] __mutex_lock+0x19d/0x1550 [ 102.003123][ T5328] md_start_sync+0x179/0x1010 [ 102.005517][ T5328] process_scheduled_works+0xc3d/0x1630 [ 102.008272][ T5328] worker_thread+0xa47/0xfb0 [ 102.010634][ T5328] kthread+0x38b/0x480 [ 102.012743][ T5328] ret_from_fork+0x514/0xb70 [ 102.015134][ T5328] ret_from_fork_asm+0x1a/0x30 [ 102.017665][ T5328] [ 102.017665][ T5328] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 102.021889][ T5328] process_scheduled_works+0xc03/0x1630 [ 102.024658][ T5328] worker_thread+0xa47/0xfb0 [ 102.027022][ T5328] kthread+0x38b/0x480 [ 102.029157][ T5328] ret_from_fork+0x514/0xb70 [ 102.031371][ T5328] ret_from_fork_asm+0x1a/0x30 [ 102.033467][ T5328] [ 102.033467][ T5328] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 102.036646][ T5328] touch_wq_lockdep_map+0xcb/0x180 [ 102.038929][ T5328] __flush_workqueue+0x148/0x1470 [ 102.041226][ T5328] md_alloc+0x32/0xf20 [ 102.043137][ T5328] md_alloc_and_put+0x1a/0x1f0 [ 102.045304][ T5328] blk_request_module+0x27d/0x2a0 [ 102.047727][ T5328] blkdev_get_no_open+0x3f/0xe0 [ 102.052666][ T5328] blkdev_open+0x1d7/0x600 [ 102.054840][ T5328] do_dentry_open+0x816/0x1380 [ 102.057052][ T5328] vfs_open+0x3b/0x340 [ 102.059409][ T5328] path_openat+0x1443/0x1d60 [ 102.062158][ T5328] do_file_open+0x23e/0x4a0 [ 102.064540][ T5328] do_sys_openat2+0x115/0x200 [ 102.066887][ T5328] __x64_sys_openat+0x138/0x170 [ 102.069333][ T5328] do_syscall_64+0x166/0x520 [ 102.071664][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.074367][ T5328] [ 102.074367][ T5328] -> #0 (major_names_lock){+.+.}-{4:4}: [ 102.077716][ T5328] __lock_acquire+0x164c/0x2de0 [ 102.080224][ T5328] lock_acquire+0x115/0x350 [ 102.082554][ T5328] __mutex_lock+0x19d/0x1550 [ 102.084912][ T5328] blk_request_module+0x35/0x2a0 [ 102.087413][ T5328] blkdev_get_no_open+0x3f/0xe0 [ 102.089794][ T5328] bdev_file_open_by_dev+0xa0/0x240 [ 102.092384][ T5328] md_import_device+0x2e9/0x650 [ 102.094720][ T5328] md_add_new_disk+0x669/0x1850 [ 102.097135][ T5328] md_ioctl+0x200a/0x2610 [ 102.099220][ T5328] blkdev_ioctl+0x5e3/0x740 [ 102.101261][ T5328] __se_sys_ioctl+0xfc/0x170 [ 102.103445][ T5328] do_syscall_64+0x166/0x520 [ 102.105650][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.108457][ T5328] [ 102.108457][ T5328] other info that might help us debug this: [ 102.108457][ T5328] [ 102.112610][ T5328] Chain exists of: [ 102.112610][ T5328] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 102.112610][ T5328] [ 102.118862][ T5328] Possible unsafe locking scenario: [ 102.118862][ T5328] [ 102.122129][ T5328] CPU0 CPU1 [ 102.124702][ T5328] ---- ---- [ 102.127432][ T5328] lock(&mddev->reconfig_mutex); [ 102.129625][ T5328] lock((work_completion)(&mddev->sync_work)); [ 102.133536][ T5328] lock(&mddev->reconfig_mutex); [ 102.136846][ T5328] lock(major_names_lock); [ 102.138619][ T5328] [ 102.138619][ T5328] *** DEADLOCK *** [ 102.138619][ T5328] [ 102.141986][ T5328] locks held by syz.0.0/5328: 1, last CPU#0: [ 102.144661][ T5328] #0: ffff88803790a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 102.149433][ T5328] [ 102.149433][ T5328] stack backtrace: [ 102.152069][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.156025][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.160443][ T5328] Call Trace: [ 102.162020][ T5328] [ 102.163389][ T5328] dump_stack_lvl+0xe8/0x150 [ 102.165458][ T5328] print_circular_bug+0x2e2/0x300 [ 102.167660][ T5328] check_noncircular+0x12f/0x150 [ 102.169921][ T5328] __lock_acquire+0x164c/0x2de0 [ 102.172105][ T5328] ? post_alloc_hook+0x208/0x250 [ 102.174360][ T5328] ? get_page_from_freelist+0x2209/0x2280 [ 102.176908][ T5328] lock_acquire+0x115/0x350 [ 102.178959][ T5328] ? blk_request_module+0x35/0x2a0 [ 102.181224][ T5328] __mutex_lock+0x19d/0x1550 [ 102.183210][ T5328] ? blk_request_module+0x35/0x2a0 [ 102.185498][ T5328] ? lock_acquire+0x115/0x350 [ 102.187575][ T5328] ? blk_request_module+0x35/0x2a0 [ 102.189786][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 102.192000][ T5328] ? find_inode_fast+0x5dc/0x740 [ 102.194229][ T5328] ? find_inode_fast+0xd2/0x740 [ 102.196429][ T5328] blk_request_module+0x35/0x2a0 [ 102.198631][ T5328] blkdev_get_no_open+0x3f/0xe0 [ 102.200717][ T5328] bdev_file_open_by_dev+0xa0/0x240 [ 102.203081][ T5328] md_import_device+0x2e9/0x650 [ 102.205271][ T5328] md_add_new_disk+0x669/0x1850 [ 102.207480][ T5328] md_ioctl+0x200a/0x2610 [ 102.209534][ T5328] ? tomoyo_path_number_perm+0x219/0x5f0 [ 102.212090][ T5328] ? __pfx_md_ioctl+0x10/0x10 [ 102.214229][ T5328] ? do_vfs_ioctl+0x116f/0x1530 [ 102.216426][ T5328] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 102.218723][ T5328] ? hook_file_ioctl+0x1f2/0x600 [ 102.220997][ T5328] ? __pfx_md_ioctl+0x10/0x10 [ 102.223134][ T5328] blkdev_ioctl+0x5e3/0x740 [ 102.225206][ T5328] ? __pfx_blkdev_ioctl+0x10/0x10 [ 102.227481][ T5328] ? __fget_files+0x2a/0x420 [ 102.229611][ T5328] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.231789][ T5328] ? __pfx_blkdev_ioctl+0x10/0x10 [ 102.234032][ T5328] __se_sys_ioctl+0xfc/0x170 [ 102.236083][ T5328] do_syscall_64+0x166/0x520 [ 102.238177][ T5328] ? trace_irq_disable+0x3b/0x140 [ 102.240456][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.243198][ T5328] ? clear_bhb_loop+0x70/0xc0 [ 102.245214][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.247820][ T5328] RIP: 0033:0x7fd0cdf9e159 [ 102.249875][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.258343][ T5328] RSP: 002b:00007fd0cee5dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.262091][ T5328] RAX: ffffffffffffffda RBX: 00007fd0ce226090 RCX: 00007fd0cdf9e159 [ 102.265631][ T5328] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 102.269201][ T5328] RBP: 00007fd0ce03506b R08: 0000000000000000 R09: 0000000000000000 [ 102.272694][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.276226][ T5328] R13: 00007fd0ce226128 R14: 00007fd0ce226090 R15: 00007ffdf8f02128 [ 102.279768][ T5328] [ 102.290988][ T5331] md: resync of RAID array md0 [ 102.298955][ T5331] md: md0: resync done. [ 102.333518][ T5328] block device autoloading is deprecated and will be removed. [ 102.337417][ T5332] md: recover of RAID array md0 [ 102.346101][ T5332] md: md0: recover done.