program: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000005000000010000000100001302000000010000000000000000000000005f"], 0x0, 0x35}, 0x28) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000280)={[0x8]}, 0x8, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') socket$nl_generic(0x10, 0x3, 0x10) fanotify_init(0x2, 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRES32=r0, @ANYBLOB="0000000003120100280012800b00010062726964676500001800028005002c00020000000c002e"], 0x48}, 0x1, 0x0, 0x0, 0xe3879301936891d9}, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f00000000c0)=0x4, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket(0x400000000010, 0x3, 0x0) write(r3, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030004000500e1000c0400070080000900", 0x33a) [ 124.060920][ T5285] Bluetooth: hci0: command tx timeout [ 124.306828][ T5320] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 124.307407][ T5321] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 124.307999][ T5321] block device autoloading is deprecated and will be removed. [ 124.394273][ T5320] md/raid10:md0: not clean -- starting background reconstruction [ 124.394290][ T5320] md/raid10:md0: active with 1 out of 2 devices [ 124.397245][ T5320] md0: detected capacity change from 0 to 2048 [ 124.419349][ T5327] md: resync of RAID array md0 [ 124.421389][ T5321] [ 124.424782][ T5321] ====================================================== [ 124.427723][ T5321] WARNING: possible circular locking dependency detected [ 124.430854][ T5321] syzkaller #0 Not tainted [ 124.432890][ T5321] ------------------------------------------------------ [ 124.435936][ T5321] syz.0.0/5321 is trying to acquire lock: [ 124.438307][ T5321] ffffffff8f554d80 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 124.442282][ T5321] [ 124.442282][ T5321] but task is already holding lock: [ 124.445356][ T5321] ffff888012b00358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 124.449994][ T5321] [ 124.449994][ T5321] which lock already depends on the new lock. [ 124.449994][ T5321] [ 124.454604][ T5321] [ 124.454604][ T5321] the existing dependency chain (in reverse order) is: [ 124.458457][ T5321] [ 124.458457][ T5321] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 124.461809][ T5321] __mutex_lock+0x19d/0x1550 [ 124.464003][ T5321] md_start_sync+0x179/0x1010 [ 124.466352][ T5321] process_scheduled_works+0xc3d/0x1630 [ 124.469224][ T5321] worker_thread+0xa47/0xfb0 [ 124.471645][ T5321] kthread+0x38b/0x480 [ 124.473884][ T5321] ret_from_fork+0x514/0xb70 [ 124.476196][ T5321] ret_from_fork_asm+0x1a/0x30 [ 124.478619][ T5321] [ 124.478619][ T5321] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 124.482841][ T5321] process_scheduled_works+0xc03/0x1630 [ 124.485542][ T5321] worker_thread+0xa47/0xfb0 [ 124.487841][ T5321] kthread+0x38b/0x480 [ 124.489905][ T5321] ret_from_fork+0x514/0xb70 [ 124.492144][ T5321] ret_from_fork_asm+0x1a/0x30 [ 124.494540][ T5321] [ 124.494540][ T5321] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 124.498295][ T5321] touch_wq_lockdep_map+0xcb/0x180 [ 124.500688][ T5321] __flush_workqueue+0x148/0x1470 [ 124.502846][ T5321] md_alloc+0x32/0xf20 [ 124.504544][ T5321] md_alloc_and_put+0x1a/0x1f0 [ 124.506763][ T5321] blk_request_module+0x27d/0x2a0 [ 124.509052][ T5321] blkdev_get_no_open+0x3f/0xe0 [ 124.511187][ T5321] blkdev_open+0x1d7/0x600 [ 124.513456][ T5321] do_dentry_open+0x816/0x1380 [ 124.515842][ T5321] vfs_open+0x3b/0x340 [ 124.517949][ T5321] path_openat+0x1443/0x1d60 [ 124.520179][ T5321] do_file_open+0x23e/0x4a0 [ 124.522495][ T5321] do_sys_openat2+0x115/0x200 [ 124.524821][ T5321] __x64_sys_openat+0x138/0x170 [ 124.527285][ T5321] do_syscall_64+0x166/0x520 [ 124.529599][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.532522][ T5321] [ 124.532522][ T5321] -> #0 (major_names_lock){+.+.}-{4:4}: [ 124.535928][ T5321] __lock_acquire+0x164c/0x2de0 [ 124.538425][ T5321] lock_acquire+0x115/0x350 [ 124.540711][ T5321] __mutex_lock+0x19d/0x1550 [ 124.543012][ T5321] blk_request_module+0x35/0x2a0 [ 124.545349][ T5321] blkdev_get_no_open+0x3f/0xe0 [ 124.547726][ T5321] bdev_file_open_by_dev+0xa0/0x240 [ 124.550313][ T5321] md_import_device+0x2e9/0x650 [ 124.552738][ T5321] md_add_new_disk+0x669/0x1850 [ 124.555034][ T5321] md_ioctl+0x200a/0x2610 [ 124.557118][ T5321] blkdev_ioctl+0x5e3/0x740 [ 124.559377][ T5321] __se_sys_ioctl+0xfc/0x170 [ 124.561592][ T5321] do_syscall_64+0x166/0x520 [ 124.563863][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.566688][ T5321] [ 124.566688][ T5321] other info that might help us debug this: [ 124.566688][ T5321] [ 124.571160][ T5321] Chain exists of: [ 124.571160][ T5321] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 124.571160][ T5321] [ 124.578026][ T5321] Possible unsafe locking scenario: [ 124.578026][ T5321] [ 124.581173][ T5321] CPU0 CPU1 [ 124.583399][ T5321] ---- ---- [ 124.585594][ T5321] lock(&mddev->reconfig_mutex); [ 124.587697][ T5321] lock((work_completion)(&mddev->sync_work)); [ 124.590986][ T5321] lock(&mddev->reconfig_mutex); [ 124.593663][ T5321] lock(major_names_lock); [ 124.595676][ T5321] [ 124.595676][ T5321] *** DEADLOCK *** [ 124.595676][ T5321] [ 124.599296][ T5321] locks held by syz.0.0/5321: 1, last CPU#0: [ 124.602019][ T5321] #0: ffff888012b00358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 124.606777][ T5321] [ 124.606777][ T5321] stack backtrace: [ 124.609383][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 124.613315][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.617841][ T5321] Call Trace: [ 124.619373][ T5321] [ 124.620667][ T5321] dump_stack_lvl+0xe8/0x150 [ 124.622472][ T5321] print_circular_bug+0x2e2/0x300 [ 124.624568][ T5321] check_noncircular+0x12f/0x150 [ 124.626879][ T5321] __lock_acquire+0x164c/0x2de0 [ 124.629081][ T5321] ? post_alloc_hook+0x208/0x250 [ 124.631351][ T5321] ? get_page_from_freelist+0x2209/0x2280 [ 124.633985][ T5321] lock_acquire+0x115/0x350 [ 124.636047][ T5321] ? blk_request_module+0x35/0x2a0 [ 124.638415][ T5321] __mutex_lock+0x19d/0x1550 [ 124.640523][ T5321] ? blk_request_module+0x35/0x2a0 [ 124.643195][ T5321] ? lock_acquire+0x115/0x350 [ 124.645805][ T5321] ? blk_request_module+0x35/0x2a0 [ 124.648065][ T5321] ? __pfx___mutex_lock+0x10/0x10 [ 124.650202][ T5321] ? find_inode_fast+0x5dc/0x740 [ 124.652431][ T5321] ? find_inode_fast+0xd2/0x740 [ 124.654531][ T5321] blk_request_module+0x35/0x2a0 [ 124.656636][ T5321] blkdev_get_no_open+0x3f/0xe0 [ 124.658782][ T5321] bdev_file_open_by_dev+0xa0/0x240 [ 124.661057][ T5321] md_import_device+0x2e9/0x650 [ 124.663283][ T5321] md_add_new_disk+0x669/0x1850 [ 124.665352][ T5321] md_ioctl+0x200a/0x2610 [ 124.667292][ T5321] ? tomoyo_path_number_perm+0x219/0x5f0 [ 124.669820][ T5321] ? __pfx_md_ioctl+0x10/0x10 [ 124.671887][ T5321] ? do_vfs_ioctl+0x116f/0x1530 [ 124.674115][ T5321] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 124.676264][ T5321] ? hook_file_ioctl+0x1f2/0x600 [ 124.678443][ T5321] ? __pfx_md_ioctl+0x10/0x10 [ 124.680470][ T5321] blkdev_ioctl+0x5e3/0x740 [ 124.682531][ T5321] ? __pfx_blkdev_ioctl+0x10/0x10 [ 124.684822][ T5321] ? __fget_files+0x2a/0x420 [ 124.686753][ T5321] ? bpf_lsm_file_ioctl+0x9/0x20 [ 124.688998][ T5321] ? __pfx_blkdev_ioctl+0x10/0x10 [ 124.691222][ T5321] __se_sys_ioctl+0xfc/0x170 [ 124.693284][ T5321] do_syscall_64+0x166/0x520 [ 124.695362][ T5321] ? trace_irq_disable+0x3b/0x140 [ 124.697413][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.699943][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 124.702104][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.704621][ T5321] RIP: 0033:0x7f8f9ab9e159 [ 124.706604][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.715087][ T5321] RSP: 002b:00007f8f9bb06fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.718720][ T5321] RAX: ffffffffffffffda RBX: 00007f8f9ae26090 RCX: 00007f8f9ab9e159 [ 124.722178][ T5321] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 000000000000000a [ 124.725635][ T5321] RBP: 00007f8f9ac3503b R08: 0000000000000000 R09: 0000000000000000 [ 124.728937][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.732374][ T5321] R13: 00007f8f9ae26128 R14: 00007f8f9ae26090 R15: 00007ffd6be825a8 [ 124.735842][ T5321] [ 124.810352][ T5327] md: md0: resync done. [ 124.876863][ T5321] md: could not open device unknown-block(0,0). [ 124.876899][ T5321] md: md_import_device returned -6