program: io_uring_setup(0x115a, &(0x7f0000000440)={0x0, 0x4ef1, 0x40, 0x0, 0x4d5}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1fe) syz_emit_ethernet(0x22, &(0x7f0000000780)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x2, 0x0, 0x14, 0x67, 0x0, 0x2, 0x67, 0x0, @rand_addr=0x64010100, @broadcast}}}}}, 0x0) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 93.755943][ T5278] Bluetooth: hci0: command tx timeout [ 93.780212][ T1238] cfg80211: failed to load regulatory.db [ 93.915382][ T5314] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 93.917377][ T5315] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 93.917525][ T5315] block device autoloading is deprecated and will be removed. [ 94.000792][ T5314] md/raid10:md0: not clean -- starting background reconstruction [ 94.000810][ T5314] md/raid10:md0: active with 1 out of 2 devices [ 94.013166][ T5314] md0: detected capacity change from 0 to 2048 [ 94.020740][ T5318] md: resync of RAID array md0 [ 94.021957][ T5315] [ 94.027543][ T5315] ====================================================== [ 94.030694][ T5315] WARNING: possible circular locking dependency detected [ 94.034212][ T5315] syzkaller #0 Not tainted [ 94.036128][ T5315] ------------------------------------------------------ [ 94.038981][ T5315] syz.0.0/5315 is trying to acquire lock: [ 94.041473][ T5315] ffffffff8f555740 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 94.045279][ T5315] [ 94.045279][ T5315] but task is already holding lock: [ 94.048062][ T5315] ffff888012c24358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 94.052354][ T5315] [ 94.052354][ T5315] which lock already depends on the new lock. [ 94.052354][ T5315] [ 94.056776][ T5315] [ 94.056776][ T5315] the existing dependency chain (in reverse order) is: [ 94.060461][ T5315] [ 94.060461][ T5315] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 94.063855][ T5315] __mutex_lock+0x19d/0x1550 [ 94.065971][ T5315] md_start_sync+0x179/0x1010 [ 94.068235][ T5315] process_scheduled_works+0xc3d/0x1630 [ 94.070842][ T5315] worker_thread+0xa47/0xfb0 [ 94.073112][ T5315] kthread+0x38b/0x480 [ 94.075155][ T5315] ret_from_fork+0x514/0xb70 [ 94.077296][ T5315] ret_from_fork_asm+0x1a/0x30 [ 94.079483][ T5315] [ 94.079483][ T5315] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 94.083349][ T5315] process_scheduled_works+0xc03/0x1630 [ 94.086013][ T5315] worker_thread+0xa47/0xfb0 [ 94.088194][ T5315] kthread+0x38b/0x480 [ 94.089987][ T5315] ret_from_fork+0x514/0xb70 [ 94.091917][ T5315] ret_from_fork_asm+0x1a/0x30 [ 94.094077][ T5315] [ 94.094077][ T5315] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 94.097562][ T5315] touch_wq_lockdep_map+0xcb/0x180 [ 94.099984][ T5315] __flush_workqueue+0x148/0x1470 [ 94.102474][ T5315] md_alloc+0x32/0xf20 [ 94.104443][ T5315] md_alloc_and_put+0x1a/0x1f0 [ 94.106768][ T5315] blk_request_module+0x27d/0x2a0 [ 94.109407][ T5315] blkdev_get_no_open+0x3f/0xe0 [ 94.111947][ T5315] blkdev_open+0x1d7/0x600 [ 94.114166][ T5315] do_dentry_open+0x816/0x1380 [ 94.116596][ T5315] vfs_open+0x3b/0x340 [ 94.118752][ T5315] path_openat+0x1443/0x1d60 [ 94.121064][ T5315] do_file_open+0x23e/0x4a0 [ 94.123387][ T5315] do_sys_openat2+0x115/0x200 [ 94.125842][ T5315] __x64_sys_openat+0x138/0x170 [ 94.128126][ T5315] do_syscall_64+0x166/0x520 [ 94.130239][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.132952][ T5315] [ 94.132952][ T5315] -> #0 (major_names_lock){+.+.}-{4:4}: [ 94.136448][ T5315] __lock_acquire+0x164c/0x2de0 [ 94.139394][ T5315] lock_acquire+0x115/0x350 [ 94.141722][ T5315] __mutex_lock+0x19d/0x1550 [ 94.144058][ T5315] blk_request_module+0x35/0x2a0 [ 94.146444][ T5315] blkdev_get_no_open+0x3f/0xe0 [ 94.148920][ T5315] bdev_file_open_by_dev+0xa0/0x240 [ 94.151945][ T5315] md_import_device+0x2e9/0x650 [ 94.154605][ T5315] md_add_new_disk+0x669/0x1850 [ 94.156971][ T5315] md_ioctl+0x1fe4/0x2610 [ 94.159095][ T5315] blkdev_ioctl+0x5e3/0x740 [ 94.161340][ T5315] __se_sys_ioctl+0xfc/0x170 [ 94.163366][ T5315] do_syscall_64+0x166/0x520 [ 94.165621][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.168462][ T5315] [ 94.168462][ T5315] other info that might help us debug this: [ 94.168462][ T5315] [ 94.172966][ T5315] Chain exists of: [ 94.172966][ T5315] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 94.172966][ T5315] [ 94.179288][ T5315] Possible unsafe locking scenario: [ 94.179288][ T5315] [ 94.182443][ T5315] CPU0 CPU1 [ 94.184711][ T5315] ---- ---- [ 94.186950][ T5315] lock(&mddev->reconfig_mutex); [ 94.188958][ T5315] lock((work_completion)(&mddev->sync_work)); [ 94.192314][ T5315] lock(&mddev->reconfig_mutex); [ 94.195191][ T5315] lock(major_names_lock); [ 94.196897][ T5315] [ 94.196897][ T5315] *** DEADLOCK *** [ 94.196897][ T5315] [ 94.200328][ T5315] locks held by syz.0.0/5315: 1, last CPU#0: [ 94.202844][ T5315] #0: ffff888012c24358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 94.207074][ T5315] [ 94.207074][ T5315] stack backtrace: [ 94.209497][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.213142][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.217299][ T5315] Call Trace: [ 94.218678][ T5315] [ 94.219935][ T5315] dump_stack_lvl+0xe8/0x150 [ 94.221794][ T5315] print_circular_bug+0x2e2/0x300 [ 94.223809][ T5315] check_noncircular+0x12f/0x150 [ 94.226169][ T5315] __lock_acquire+0x164c/0x2de0 [ 94.228405][ T5315] ? post_alloc_hook+0x208/0x250 [ 94.230959][ T5315] ? get_page_from_freelist+0x2209/0x2280 [ 94.234115][ T5315] lock_acquire+0x115/0x350 [ 94.236010][ T5315] ? blk_request_module+0x35/0x2a0 [ 94.238280][ T5315] __mutex_lock+0x19d/0x1550 [ 94.240161][ T5315] ? blk_request_module+0x35/0x2a0 [ 94.242404][ T5315] ? lock_acquire+0x115/0x350 [ 94.244486][ T5315] ? blk_request_module+0x35/0x2a0 [ 94.246649][ T5315] ? __pfx___mutex_lock+0x10/0x10 [ 94.248801][ T5315] ? find_inode_fast+0x5dc/0x740 [ 94.250830][ T5315] ? find_inode_fast+0xd2/0x740 [ 94.252865][ T5315] blk_request_module+0x35/0x2a0 [ 94.254892][ T5315] blkdev_get_no_open+0x3f/0xe0 [ 94.256987][ T5315] bdev_file_open_by_dev+0xa0/0x240 [ 94.259304][ T5315] md_import_device+0x2e9/0x650 [ 94.261634][ T5315] md_add_new_disk+0x669/0x1850 [ 94.263872][ T5315] md_ioctl+0x1fe4/0x2610 [ 94.265857][ T5315] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.268376][ T5315] ? __pfx_md_ioctl+0x10/0x10 [ 94.270732][ T5315] ? do_vfs_ioctl+0x116f/0x1530 [ 94.273013][ T5315] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.275242][ T5315] ? hook_file_ioctl+0x1f2/0x600 [ 94.277417][ T5315] ? __pfx_md_ioctl+0x10/0x10 [ 94.279565][ T5315] blkdev_ioctl+0x5e3/0x740 [ 94.281682][ T5315] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.284001][ T5315] ? __fget_files+0x2a/0x420 [ 94.286160][ T5315] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.288431][ T5315] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.290701][ T5315] __se_sys_ioctl+0xfc/0x170 [ 94.292871][ T5315] do_syscall_64+0x166/0x520 [ 94.295007][ T5315] ? trace_irq_disable+0x3b/0x140 [ 94.297235][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.299891][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 94.302070][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.304706][ T5315] RIP: 0033:0x7f6ef639e159 [ 94.306580][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.314705][ T5315] RSP: 002b:00007f6ef7283fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.317886][ T5315] RAX: ffffffffffffffda RBX: 00007f6ef6626090 RCX: 00007f6ef639e159 [ 94.321388][ T5315] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000005 [ 94.324877][ T5315] RBP: 00007f6ef643503b R08: 0000000000000000 R09: 0000000000000000 [ 94.328011][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.331182][ T5315] R13: 00007f6ef6626128 R14: 00007f6ef6626090 R15: 00007fff7086f9e8 [ 94.334681][ T5315] [ 94.408186][ T5318] md: md0: resync done. [ 94.427242][ T5315] block device autoloading is deprecated and will be removed. [ 94.427934][ T5320] md: recover of RAID array md0 [ 94.427947][ T5320] md: md0: recover done.