program: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x159}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, 0x0, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4000, 0x20000000, 0x2b2, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5631, 0x40000, 0x2, 0x200ac}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x32f4, 0x400, 0x0, 0x1f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000bc0)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x101081, 0x0) write(r6, &(0x7f0000000440)='md0', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/md0\x00', 0x105042, 0x0) ioctl(r7, 0x40480923, &(0x7f0000000540)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r7, 0x40140921, &(0x7f00000005c0)="0100000001000000010000000100000006") openat(0xffffffffffffff9c, 0x0, 0x42, 0x1b6) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000ac0), 0x1, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r8, 0x40085112, &(0x7f0000000d80)=@v={0x93, 0x3, 0x80, 0x1c, @MIDI_NOTEON=@special, 0x8, 0x2}) ioctl(r7, 0x400c0930, 0x0) renameat2(r6, &(0x7f0000000c80)='./sys\x00', r6, &(0x7f0000000cc0)='./dev\x00', 0x3) ioctl(r7, 0x40140921, 0x0) [ 95.748722][ T4660] Bluetooth: hci0: command tx timeout [ 95.984931][ T5337] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.985060][ T5337] block device autoloading is deprecated and will be removed. [ 95.994456][ T5336] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 96.068245][ T5336] md/raid10:md0: not clean -- starting background reconstruction [ 96.068260][ T5336] md/raid10:md0: active with 1 out of 2 devices [ 96.069167][ T5336] md0: detected capacity change from 0 to 2048 [ 96.083735][ T5336] [ 96.084714][ T5336] ====================================================== [ 96.087478][ T5336] WARNING: possible circular locking dependency detected [ 96.090084][ T5336] syzkaller #0 Not tainted [ 96.091946][ T5336] ------------------------------------------------------ [ 96.094984][ T5336] syz.0.0/5336 is trying to acquire lock: [ 96.097558][ T5336] ffffffff9096ebe0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 96.101922][ T5336] [ 96.101922][ T5336] but task is already holding lock: [ 96.105089][ T5336] ffff888014124358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 96.109680][ T5336] [ 96.109680][ T5336] which lock already depends on the new lock. [ 96.109680][ T5336] [ 96.114080][ T5336] [ 96.114080][ T5336] the existing dependency chain (in reverse order) is: [ 96.117966][ T5336] [ 96.117966][ T5336] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 96.121450][ T5336] __mutex_lock+0x197/0x15a0 [ 96.123635][ T5336] md_alloc+0x81e/0xf40 [ 96.125640][ T5336] md_alloc_and_put+0x1a/0x1f0 [ 96.127943][ T5336] add_named_array+0x240/0x350 [ 96.130275][ T5336] param_attr_store+0x214/0x310 [ 96.132634][ T5336] module_attr_store+0x65/0x90 [ 96.134867][ T5336] kernfs_fop_write_iter+0x3a4/0x540 [ 96.137933][ T5336] vfs_write+0x612/0xba0 [ 96.140317][ T5336] ksys_write+0x150/0x270 [ 96.142444][ T5336] do_syscall_64+0x16a/0x530 [ 96.144606][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.147323][ T5336] [ 96.147323][ T5336] -> #1 (disks_mutex){+.+.}-{4:4}: [ 96.150460][ T5336] __mutex_lock+0x197/0x15a0 [ 96.152678][ T5336] md_alloc+0x40/0xf40 [ 96.154665][ T5336] md_alloc_and_put+0x1a/0x1f0 [ 96.157004][ T5336] blk_request_module+0x27d/0x2a0 [ 96.159453][ T5336] blkdev_get_no_open+0x3f/0xe0 [ 96.161814][ T5336] blkdev_open+0x1d7/0x600 [ 96.164009][ T5336] do_dentry_open+0x80e/0x1360 [ 96.166449][ T5336] vfs_open_consume+0x4a/0x350 [ 96.168700][ T5336] path_openat+0x16fc/0x20f0 [ 96.170768][ T5336] do_file_open+0x23e/0x4a0 [ 96.172864][ T5336] do_sys_openat2+0x115/0x200 [ 96.175042][ T5336] __x64_sys_openat+0x138/0x170 [ 96.177488][ T5336] do_syscall_64+0x16a/0x530 [ 96.179573][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.182327][ T5336] [ 96.182327][ T5336] -> #0 (major_names_lock){+.+.}-{4:4}: [ 96.185515][ T5336] __lock_acquire+0x164c/0x2de0 [ 96.187761][ T5336] lock_acquire+0x115/0x350 [ 96.189866][ T5336] __mutex_lock+0x197/0x15a0 [ 96.192039][ T5336] blk_request_module+0x35/0x2a0 [ 96.194408][ T5336] blkdev_get_no_open+0x3f/0xe0 [ 96.196719][ T5336] bdev_file_open_by_dev+0xa0/0x240 [ 96.199194][ T5336] md_import_device+0x2e9/0x650 [ 96.201565][ T5336] md_add_new_disk+0x669/0x1850 [ 96.203875][ T5336] md_ioctl+0x2027/0x2630 [ 96.205967][ T5336] blkdev_ioctl+0x5e3/0x740 [ 96.208105][ T5336] __se_sys_ioctl+0xfc/0x170 [ 96.210282][ T5336] do_syscall_64+0x16a/0x530 [ 96.212500][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.215278][ T5336] [ 96.215278][ T5336] other info that might help us debug this: [ 96.215278][ T5336] [ 96.219567][ T5336] Chain exists of: [ 96.219567][ T5336] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 96.219567][ T5336] [ 96.224930][ T5336] Possible unsafe locking scenario: [ 96.224930][ T5336] [ 96.228093][ T5336] CPU0 CPU1 [ 96.230468][ T5336] ---- ---- [ 96.232865][ T5336] lock(&mddev->reconfig_mutex); [ 96.235099][ T5336] lock(disks_mutex); [ 96.238010][ T5336] lock(&mddev->reconfig_mutex); [ 96.241204][ T5336] lock(major_names_lock); [ 96.243300][ T5336] [ 96.243300][ T5336] *** DEADLOCK *** [ 96.243300][ T5336] [ 96.246886][ T5336] locks held by syz.0.0/5336: 1, on CPU#0: [ 96.249353][ T5336] #0: ffff888014124358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 96.253750][ T5336] [ 96.253750][ T5336] stack backtrace: [ 96.256208][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.260092][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.264456][ T5336] Call Trace: [ 96.265894][ T5336] [ 96.267094][ T5336] dump_stack_lvl+0xe8/0x150 [ 96.269127][ T5336] print_circular_bug+0x2e2/0x300 [ 96.271293][ T5336] check_noncircular+0x12f/0x150 [ 96.273478][ T5336] __lock_acquire+0x164c/0x2de0 [ 96.275735][ T5336] ? post_alloc_hook+0x208/0x250 [ 96.277907][ T5336] ? get_page_from_freelist+0x2224/0x2290 [ 96.280407][ T5336] lock_acquire+0x115/0x350 [ 96.282417][ T5336] ? blk_request_module+0x35/0x2a0 [ 96.284478][ T5336] __mutex_lock+0x197/0x15a0 [ 96.286745][ T5336] ? blk_request_module+0x35/0x2a0 [ 96.288948][ T5336] ? lock_acquire+0x115/0x350 [ 96.290939][ T5336] ? blk_request_module+0x35/0x2a0 [ 96.293060][ T5336] ? __pfx___mutex_lock+0x10/0x10 [ 96.295227][ T5336] ? find_inode_fast+0x5dc/0x740 [ 96.297549][ T5336] ? find_inode_fast+0xd2/0x740 [ 96.299669][ T5336] blk_request_module+0x35/0x2a0 [ 96.301721][ T5336] blkdev_get_no_open+0x3f/0xe0 [ 96.303892][ T5336] bdev_file_open_by_dev+0xa0/0x240 [ 96.306303][ T5336] md_import_device+0x2e9/0x650 [ 96.308478][ T5336] md_add_new_disk+0x669/0x1850 [ 96.310517][ T5336] md_ioctl+0x2027/0x2630 [ 96.312482][ T5336] ? tomoyo_path_number_perm+0x219/0x5f0 [ 96.314952][ T5336] ? __pfx_md_ioctl+0x10/0x10 [ 96.317051][ T5336] ? do_vfs_ioctl+0x116f/0x1530 [ 96.319145][ T5336] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 96.321261][ T5336] ? do_futex+0x458/0x4e0 [ 96.323194][ T5336] ? __pfx_md_ioctl+0x10/0x10 [ 96.325158][ T5336] blkdev_ioctl+0x5e3/0x740 [ 96.327483][ T5336] ? __pfx_blkdev_ioctl+0x10/0x10 [ 96.330096][ T5336] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.332336][ T5336] ? __pfx_blkdev_ioctl+0x10/0x10 [ 96.334451][ T5336] __se_sys_ioctl+0xfc/0x170 [ 96.336440][ T5336] do_syscall_64+0x16a/0x530 [ 96.338408][ T5336] ? trace_irq_disable+0x3b/0x140 [ 96.340476][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.343025][ T5336] ? clear_bhb_loop+0x70/0xc0 [ 96.344942][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.347425][ T5336] RIP: 0033:0x7f398e1a8f19 [ 96.349356][ T5336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.357468][ T5336] RSP: 002b:00007f398f0a3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.360975][ T5336] RAX: ffffffffffffffda RBX: 00007f398e425fa0 RCX: 00007f398e1a8f19 [ 96.364537][ T5336] RDX: 0000000000000000 RSI: 0000000040140921 RDI: 0000000000000007 [ 96.368009][ T5336] RBP: 00007f398e237f6d R08: 0000000000000000 R09: 0000000000000000 [ 96.371295][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.374600][ T5336] R13: 00007f398e426038 R14: 00007f398e425fa0 R15: 00007ffe171c9738 [ 96.377965][ T5336] [ 96.427634][ T5336] md: could not open device unknown-block(0,0). [ 96.427666][ T5336] md: md_import_device returned -6 [ 96.431273][ T5350] md: resync of RAID array md0