program: r0 = io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000340)={r0, &(0x7f00000001c0)='\x00', 0xa20140, &(0x7f0000000240)={@align=0x81, {0x0, 0x5, 0x0, 0x3}}, 0x80000001, &(0x7f0000000280), &(0x7f00000002c0)=0xffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfff00002}, {0x16}]}, 0x10) sendmsg$NL80211_CMD_SET_STATION(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001440)={0x28, r2, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0xe4, 0x71}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WOWLAN(r1, &(0x7f0000000840)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000540)={0x29c, r2, 0x0, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x63}, @val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_WOWLAN_TRIGGERS={0x278, 0x75, 0x0, 0x1, [@NL80211_WOWLAN_TRIG_PKT_PATTERN={0x160, 0x4, 0x0, 0x1, [{0x150, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_MASK={0xea, 0x1, "1c7459fd3dcb44e90c70c7e188748e2743b389589d1c29207d984a8555e8a6a2ae8b95da3e621f8551dff8b9d58f1d19cc7c4af77819b22abf705f7dab68d84853aab5fb71532f383c107dba7415d270c9ecdb66dd15eb76e6ff6fd0d1a04a3cc23c68b1d8435ac8d67879995a0d84d00ae43dbf6e1526b879159321a295dd5a213ebed94364f7ad5e343e0fe5978ed3a51b572af7db2f79d0b470c7d8f8bde00bed1b70aa920784521b9476190c6a5ac32cb4fd3c48d55909fc1b38ba10086f9893594de30238bfc7ec05238685087ecee4a5304a94e3300aa8f808c831922e4311340c4fda"}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x2}, @NL80211_PKTPAT_PATTERN={0x58, 0x2, "e10b0e7f1f656b31c481239d30aec39046f48ebfe23590bddab4ceec202eccd2887bd07bf3a550674ebc9d1ddb2a03c574195d94d88ec870c747db66b144258c037d2da601fdb82e2ee57000ca94730c1d6620cc"}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x1}]}]}, @NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE={0x4}, @NL80211_WOWLAN_TRIG_NET_DETECT={0x8, 0x12, 0x0, 0x1, [@NL80211_ATTR_SCHED_SCAN_MATCH={0x4}]}, @NL80211_WOWLAN_TRIG_NET_DETECT={0xfc, 0x12, 0x0, 0x1, [@NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCAN_SSIDS={0xb8, 0x2d, 0x0, 0x1, [{0x14, 0x0, @random="36e5d18a9513c8647cd637de684cf768"}, {0x14, 0x0, @random="a688cbd744397ed0e9e74b5049b1bd5d"}, {0x7, 0x0, @random="ec19dd"}, {0xa, 0x0, @default_ibss_ssid}, {0x24, 0x0, @random="a473d59370fb6c91dc937cb18b4ab07bbae8e300a5c7e903e509dd94d728d795"}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0x22, 0x0, @random="910230e3c316a744324d927856aa8eb0a901268bf710d499463591f337a7"}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x80}, @NL80211_ATTR_SCAN_SSIDS={0x1c, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x0, 0x8}}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, @NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST={0x4}, @NL80211_WOWLAN_TRIG_RFKILL_RELEASE={0x4}, @NL80211_WOWLAN_TRIG_RFKILL_RELEASE={0x4}]}]}, 0x29c}, 0x1, 0x0, 0x0, 0x4040055}, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r5, &(0x7f0000000200)='md0', 0x3) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r6, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r6, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r6, 0x400c0930, 0x0) ioctl(r6, 0x40140921, &(0x7f0000000440)="020000000100") [ 94.885921][ T4640] Bluetooth: hci0: command tx timeout [ 94.946694][ T5317] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 95.055322][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.060342][ T5318] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.060477][ T5318] block device autoloading is deprecated and will be removed. [ 95.137679][ T5317] md/raid10:md0: not clean -- starting background reconstruction [ 95.137694][ T5317] md/raid10:md0: active with 1 out of 2 devices [ 95.138792][ T5317] md0: detected capacity change from 0 to 2048 [ 95.162600][ T5323] md: resync of RAID array md0 [ 95.165422][ T5318] [ 95.168383][ T5318] ====================================================== [ 95.171080][ T5318] WARNING: possible circular locking dependency detected [ 95.173492][ T5318] syzkaller #0 Not tainted [ 95.175097][ T5318] ------------------------------------------------------ [ 95.177783][ T5318] syz.0.0/5318 is trying to acquire lock: [ 95.179867][ T5318] ffffffff8f556400 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 95.183493][ T5318] [ 95.183493][ T5318] but task is already holding lock: [ 95.186127][ T5318] ffff88801f55e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.189798][ T5318] [ 95.189798][ T5318] which lock already depends on the new lock. [ 95.189798][ T5318] [ 95.193606][ T5318] [ 95.193606][ T5318] the existing dependency chain (in reverse order) is: [ 95.196874][ T5318] [ 95.196874][ T5318] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 95.199978][ T5318] __mutex_lock+0x19d/0x1550 [ 95.201806][ T5318] md_start_sync+0x179/0x1010 [ 95.203712][ T5318] process_scheduled_works+0xc3d/0x1630 [ 95.206319][ T5318] worker_thread+0xa47/0xfb0 [ 95.208427][ T5318] kthread+0x38b/0x480 [ 95.210132][ T5318] ret_from_fork+0x514/0xb70 [ 95.212073][ T5318] ret_from_fork_asm+0x1a/0x30 [ 95.214104][ T5318] [ 95.214104][ T5318] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 95.217646][ T5318] process_scheduled_works+0xc03/0x1630 [ 95.219863][ T5318] worker_thread+0xa47/0xfb0 [ 95.221707][ T5318] kthread+0x38b/0x480 [ 95.223791][ T5318] ret_from_fork+0x514/0xb70 [ 95.225717][ T5318] ret_from_fork_asm+0x1a/0x30 [ 95.227684][ T5318] [ 95.227684][ T5318] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 95.230725][ T5318] touch_wq_lockdep_map+0xcb/0x180 [ 95.232800][ T5318] __flush_workqueue+0x148/0x1470 [ 95.234922][ T5318] md_alloc+0x32/0xf20 [ 95.236810][ T5318] md_alloc_and_put+0x1a/0x1f0 [ 95.238885][ T5318] blk_request_module+0x27d/0x2a0 [ 95.240944][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.242971][ T5318] blkdev_open+0x1d7/0x600 [ 95.244807][ T5318] do_dentry_open+0x816/0x1380 [ 95.246958][ T5318] vfs_open+0x3b/0x340 [ 95.248847][ T5318] path_openat+0x1443/0x1d60 [ 95.250795][ T5318] do_file_open+0x23e/0x4a0 [ 95.252667][ T5318] do_sys_openat2+0x115/0x200 [ 95.254571][ T5318] __x64_sys_openat+0x138/0x170 [ 95.256498][ T5318] do_syscall_64+0x166/0x520 [ 95.258426][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.260777][ T5318] [ 95.260777][ T5318] -> #0 (major_names_lock){+.+.}-{4:4}: [ 95.263635][ T5318] __lock_acquire+0x164c/0x2de0 [ 95.265622][ T5318] lock_acquire+0x115/0x350 [ 95.267551][ T5318] __mutex_lock+0x19d/0x1550 [ 95.269365][ T5318] blk_request_module+0x35/0x2a0 [ 95.271484][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.273672][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 95.275848][ T5318] md_import_device+0x2e9/0x650 [ 95.277932][ T5318] md_add_new_disk+0x669/0x1850 [ 95.279950][ T5318] md_ioctl+0x200a/0x2610 [ 95.281702][ T5318] blkdev_ioctl+0x5e3/0x740 [ 95.283536][ T5318] __se_sys_ioctl+0xfc/0x170 [ 95.285376][ T5318] do_syscall_64+0x166/0x520 [ 95.287365][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.289742][ T5318] [ 95.289742][ T5318] other info that might help us debug this: [ 95.289742][ T5318] [ 95.293752][ T5318] Chain exists of: [ 95.293752][ T5318] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 95.293752][ T5318] [ 95.299343][ T5318] Possible unsafe locking scenario: [ 95.299343][ T5318] [ 95.302187][ T5318] CPU0 CPU1 [ 95.304055][ T5318] ---- ---- [ 95.305981][ T5318] lock(&mddev->reconfig_mutex); [ 95.308074][ T5318] lock((work_completion)(&mddev->sync_work)); [ 95.311748][ T5318] lock(&mddev->reconfig_mutex); [ 95.315006][ T5318] lock(major_names_lock); [ 95.316955][ T5318] [ 95.316955][ T5318] *** DEADLOCK *** [ 95.316955][ T5318] [ 95.320374][ T5318] locks held by syz.0.0/5318: 1, last CPU#0: [ 95.323024][ T5318] #0: ffff88801f55e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.327523][ T5318] [ 95.327523][ T5318] stack backtrace: [ 95.330297][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.333915][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.338089][ T5318] Call Trace: [ 95.339467][ T5318] [ 95.340747][ T5318] dump_stack_lvl+0xe8/0x150 [ 95.342751][ T5318] print_circular_bug+0x2e2/0x300 [ 95.344988][ T5318] check_noncircular+0x12f/0x150 [ 95.347105][ T5318] __lock_acquire+0x164c/0x2de0 [ 95.349153][ T5318] ? post_alloc_hook+0x208/0x250 [ 95.351339][ T5318] ? get_page_from_freelist+0x2209/0x2280 [ 95.353816][ T5318] lock_acquire+0x115/0x350 [ 95.355627][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.357754][ T5318] __mutex_lock+0x19d/0x1550 [ 95.359573][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.361626][ T5318] ? lock_acquire+0x115/0x350 [ 95.363634][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.365869][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 95.367995][ T5318] ? find_inode_fast+0x5dc/0x740 [ 95.369793][ T5318] ? find_inode_fast+0xd2/0x740 [ 95.371583][ T5318] blk_request_module+0x35/0x2a0 [ 95.373314][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.375422][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 95.377627][ T5318] md_import_device+0x2e9/0x650 [ 95.379701][ T5318] md_add_new_disk+0x669/0x1850 [ 95.381903][ T5318] md_ioctl+0x200a/0x2610 [ 95.383842][ T5318] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.386369][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 95.388374][ T5318] ? do_vfs_ioctl+0x116f/0x1530 [ 95.390475][ T5318] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.392580][ T5318] ? hook_file_ioctl+0x1f2/0x600 [ 95.394714][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 95.396595][ T5318] blkdev_ioctl+0x5e3/0x740 [ 95.398443][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.400606][ T5318] ? __fget_files+0x2a/0x420 [ 95.402667][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.404872][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.407119][ T5318] __se_sys_ioctl+0xfc/0x170 [ 95.409161][ T5318] do_syscall_64+0x166/0x520 [ 95.411213][ T5318] ? trace_irq_disable+0x3b/0x140 [ 95.413484][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.416091][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 95.418265][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.420642][ T5318] RIP: 0033:0x7fe713b9e159 [ 95.422480][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.430553][ T5318] RSP: 002b:00007fe714a69fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.434128][ T5318] RAX: ffffffffffffffda RBX: 00007fe713e26090 RCX: 00007fe713b9e159 [ 95.437656][ T5318] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000005 [ 95.441121][ T5318] RBP: 00007fe713c3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.444568][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.448054][ T5318] R13: 00007fe713e26128 R14: 00007fe713e26090 R15: 00007ffc40256fa8 [ 95.451465][ T5318] [ 95.498461][ T5323] md: md0: resync done. [ 95.517154][ T5318] block device autoloading is deprecated and will be removed. [ 95.518324][ T5324] md: recover of RAID array md0 [ 95.536634][ T5324] md: md0: recover done.