program: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) io_uring_setup(0x115e, &(0x7f0000000440)={0x0, 0x4ef1, 0x40, 0x0, 0x4d5}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)="020000000100") r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r3, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000240)=@ethtool_gfeatures={0x3a, 0x3, [{}, {}, {}]}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88200182}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1d, 0x400, 0x70bd2a, 0x25dfdbfd, {0x5}, [@typed={0x8, 0x144, 0x0, 0x0, @ipv4=@private=0xa010102}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x11) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @rand_addr=0x64010101}, 0x10) sendmmsg(r0, &(0x7f0000009e80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001ec0)=[{0x10, 0x11, 0xff}], 0x10}}], 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)={0x2, 0xd, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, '\x00', 0x26}, 0x7fffffff}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x32, @loopback}}]}, 0x60}}, 0x0) [ 94.709108][ T4649] Bluetooth: hci0: command tx timeout [ 94.967202][ T5323] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.969108][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.969216][ T5324] block device autoloading is deprecated and will be removed. [ 95.040881][ T5323] md/raid10:md0: not clean -- starting background reconstruction [ 95.042386][ T5323] md/raid10:md0: active with 1 out of 2 devices [ 95.043376][ T5323] md0: detected capacity change from 0 to 2048 [ 95.062513][ T5323] [ 95.066376][ T5323] ====================================================== [ 95.069433][ T5323] WARNING: possible circular locking dependency detected [ 95.072363][ T5323] syzkaller #0 Not tainted [ 95.074314][ T5323] ------------------------------------------------------ [ 95.077301][ T5323] syz.0.0/5323 is trying to acquire lock: [ 95.079762][ T5323] ffffffff8f555740 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 95.083906][ T5323] [ 95.083906][ T5323] but task is already holding lock: [ 95.087038][ T5323] ffff8880347a6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.091479][ T5323] [ 95.091479][ T5323] which lock already depends on the new lock. [ 95.091479][ T5323] [ 95.095903][ T5323] [ 95.095903][ T5323] the existing dependency chain (in reverse order) is: [ 95.099821][ T5323] [ 95.099821][ T5323] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 95.103343][ T5323] __mutex_lock+0x19d/0x1550 [ 95.105643][ T5323] md_start_sync+0x179/0x1010 [ 95.107956][ T5323] process_scheduled_works+0xc3d/0x1630 [ 95.110621][ T5323] worker_thread+0xa47/0xfb0 [ 95.112777][ T5323] kthread+0x38b/0x480 [ 95.114667][ T5323] ret_from_fork+0x514/0xb70 [ 95.116860][ T5323] ret_from_fork_asm+0x1a/0x30 [ 95.118934][ T5323] [ 95.118934][ T5323] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 95.122807][ T5323] process_scheduled_works+0xc03/0x1630 [ 95.125406][ T5323] worker_thread+0xa47/0xfb0 [ 95.127670][ T5323] kthread+0x38b/0x480 [ 95.129676][ T5323] ret_from_fork+0x514/0xb70 [ 95.131894][ T5323] ret_from_fork_asm+0x1a/0x30 [ 95.134121][ T5323] [ 95.134121][ T5323] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 95.137260][ T5323] touch_wq_lockdep_map+0xcb/0x180 [ 95.139300][ T5323] __flush_workqueue+0x148/0x1470 [ 95.141750][ T5323] md_alloc+0x32/0xf20 [ 95.143836][ T5323] md_alloc_and_put+0x1a/0x1f0 [ 95.146116][ T5323] blk_request_module+0x27d/0x2a0 [ 95.148485][ T5323] blkdev_get_no_open+0x3f/0xe0 [ 95.150739][ T5323] blkdev_open+0x1d7/0x600 [ 95.152893][ T5323] do_dentry_open+0x816/0x1380 [ 95.155171][ T5323] vfs_open+0x3b/0x340 [ 95.157200][ T5323] path_openat+0x1443/0x1d60 [ 95.159423][ T5323] do_file_open+0x23e/0x4a0 [ 95.161614][ T5323] do_sys_openat2+0x115/0x200 [ 95.163852][ T5323] __x64_sys_openat+0x138/0x170 [ 95.166155][ T5323] do_syscall_64+0x166/0x520 [ 95.168325][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.171071][ T5323] [ 95.171071][ T5323] -> #0 (major_names_lock){+.+.}-{4:4}: [ 95.174282][ T5323] __lock_acquire+0x164c/0x2de0 [ 95.176531][ T5323] lock_acquire+0x115/0x350 [ 95.178619][ T5323] __mutex_lock+0x19d/0x1550 [ 95.180736][ T5323] blk_request_module+0x35/0x2a0 [ 95.183001][ T5323] blkdev_get_no_open+0x3f/0xe0 [ 95.185192][ T5323] bdev_file_open_by_dev+0xa0/0x240 [ 95.187496][ T5323] md_import_device+0x2e9/0x650 [ 95.189844][ T5323] md_add_new_disk+0x669/0x1850 [ 95.192192][ T5323] md_ioctl+0x1fe4/0x2610 [ 95.194348][ T5323] blkdev_ioctl+0x5e3/0x740 [ 95.196742][ T5323] __se_sys_ioctl+0xfc/0x170 [ 95.199228][ T5323] do_syscall_64+0x166/0x520 [ 95.201635][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.204580][ T5323] [ 95.204580][ T5323] other info that might help us debug this: [ 95.204580][ T5323] [ 95.208749][ T5323] Chain exists of: [ 95.208749][ T5323] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 95.208749][ T5323] [ 95.215258][ T5323] Possible unsafe locking scenario: [ 95.215258][ T5323] [ 95.218395][ T5323] CPU0 CPU1 [ 95.221240][ T5323] ---- ---- [ 95.223782][ T5323] lock(&mddev->reconfig_mutex); [ 95.226007][ T5323] lock((work_completion)(&mddev->sync_work)); [ 95.229645][ T5323] lock(&mddev->reconfig_mutex); [ 95.233465][ T5323] lock(major_names_lock); [ 95.235861][ T5323] [ 95.235861][ T5323] *** DEADLOCK *** [ 95.235861][ T5323] [ 95.239589][ T5323] locks held by syz.0.0/5323: 1, last CPU#0: [ 95.242170][ T5323] #0: ffff8880347a6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.246678][ T5323] [ 95.246678][ T5323] stack backtrace: [ 95.249203][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.253130][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.257230][ T5323] Call Trace: [ 95.258593][ T5323] [ 95.259816][ T5323] dump_stack_lvl+0xe8/0x150 [ 95.261618][ T5323] print_circular_bug+0x2e2/0x300 [ 95.263774][ T5323] check_noncircular+0x12f/0x150 [ 95.266633][ T5323] __lock_acquire+0x164c/0x2de0 [ 95.268785][ T5323] ? post_alloc_hook+0x208/0x250 [ 95.270903][ T5323] ? get_page_from_freelist+0x2209/0x2280 [ 95.273486][ T5323] lock_acquire+0x115/0x350 [ 95.275526][ T5323] ? blk_request_module+0x35/0x2a0 [ 95.277761][ T5323] __mutex_lock+0x19d/0x1550 [ 95.279820][ T5323] ? blk_request_module+0x35/0x2a0 [ 95.282090][ T5323] ? lock_acquire+0x115/0x350 [ 95.284164][ T5323] ? blk_request_module+0x35/0x2a0 [ 95.286449][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 95.288664][ T5323] ? find_inode_fast+0x5dc/0x740 [ 95.290713][ T5323] ? find_inode_fast+0xd2/0x740 [ 95.292774][ T5323] blk_request_module+0x35/0x2a0 [ 95.294734][ T5323] blkdev_get_no_open+0x3f/0xe0 [ 95.296701][ T5323] bdev_file_open_by_dev+0xa0/0x240 [ 95.298918][ T5323] md_import_device+0x2e9/0x650 [ 95.301060][ T5323] md_add_new_disk+0x669/0x1850 [ 95.303126][ T5323] md_ioctl+0x1fe4/0x2610 [ 95.305033][ T5323] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.307521][ T5323] ? __pfx_md_ioctl+0x10/0x10 [ 95.309618][ T5323] ? do_vfs_ioctl+0x116f/0x1530 [ 95.311781][ T5323] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.314019][ T5323] ? hook_file_ioctl+0x1f2/0x600 [ 95.316188][ T5323] ? __pfx_md_ioctl+0x10/0x10 [ 95.318297][ T5323] blkdev_ioctl+0x5e3/0x740 [ 95.320311][ T5323] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.322506][ T5323] ? __fget_files+0x2a/0x420 [ 95.324563][ T5323] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.326690][ T5323] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.328867][ T5323] __se_sys_ioctl+0xfc/0x170 [ 95.330927][ T5323] do_syscall_64+0x166/0x520 [ 95.333004][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.335655][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 95.337760][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.340359][ T5323] RIP: 0033:0x7fdca159e159 [ 95.342368][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.350695][ T5323] RSP: 002b:00007fdca2552fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.354312][ T5323] RAX: ffffffffffffffda RBX: 00007fdca1825fa0 RCX: 00007fdca159e159 [ 95.357742][ T5323] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000006 [ 95.361167][ T5323] RBP: 00007fdca163506b R08: 0000000000000000 R09: 0000000000000000 [ 95.364747][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.368348][ T5323] R13: 00007fdca1826038 R14: 00007fdca1825fa0 R15: 00007fff82cc9e48 [ 95.372067][ T5323] [ 95.445228][ T5323] block device autoloading is deprecated and will be removed. [ 95.445903][ T5336] md: resync of RAID array md0 [ 95.473244][ T5336] md: md0: resync done.