program: io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0x4ef1, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 148.013056][ T5281] Bluetooth: hci0: command tx timeout [ 148.222248][ T5318] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 148.229127][ T5319] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 148.229801][ T5319] block device autoloading is deprecated and will be removed. [ 148.334236][ T5318] md/raid10:md0: not clean -- starting background reconstruction [ 148.334250][ T5318] md/raid10:md0: active with 1 out of 2 devices [ 148.335119][ T5318] md0: detected capacity change from 0 to 2048 [ 148.358196][ T5319] [ 148.359283][ T5319] ====================================================== [ 148.362209][ T5319] WARNING: possible circular locking dependency detected [ 148.365077][ T5319] syzkaller #0 Not tainted [ 148.366815][ T5319] ------------------------------------------------------ [ 148.369717][ T5319] syz.0.0/5319 is trying to acquire lock: [ 148.372089][ T5319] ffffffff8f556740 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 148.376076][ T5319] [ 148.376076][ T5319] but task is already holding lock: [ 148.379074][ T5319] ffff88803574c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 148.383503][ T5319] [ 148.383503][ T5319] which lock already depends on the new lock. [ 148.383503][ T5319] [ 148.388596][ T5319] [ 148.388596][ T5319] the existing dependency chain (in reverse order) is: [ 148.392359][ T5319] [ 148.392359][ T5319] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 148.396001][ T5319] __mutex_lock+0x19d/0x1550 [ 148.398205][ T5319] md_start_sync+0x179/0x1010 [ 148.400398][ T5319] process_scheduled_works+0xc3d/0x1630 [ 148.402963][ T5319] worker_thread+0xa47/0xfb0 [ 148.405244][ T5319] kthread+0x38b/0x480 [ 148.407296][ T5319] ret_from_fork+0x514/0xb70 [ 148.409713][ T5319] ret_from_fork_asm+0x1a/0x30 [ 148.412079][ T5319] [ 148.412079][ T5319] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 148.416145][ T5319] process_scheduled_works+0xc03/0x1630 [ 148.418776][ T5319] worker_thread+0xa47/0xfb0 [ 148.420977][ T5319] kthread+0x38b/0x480 [ 148.422947][ T5319] ret_from_fork+0x514/0xb70 [ 148.425181][ T5319] ret_from_fork_asm+0x1a/0x30 [ 148.427307][ T5319] [ 148.427307][ T5319] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 148.430611][ T5319] touch_wq_lockdep_map+0xcb/0x180 [ 148.432910][ T5319] __flush_workqueue+0x148/0x1470 [ 148.435167][ T5319] md_alloc+0x32/0xf20 [ 148.437093][ T5319] md_alloc_and_put+0x1a/0x1f0 [ 148.439235][ T5319] blk_request_module+0x27d/0x2a0 [ 148.441410][ T5319] blkdev_get_no_open+0x3f/0xe0 [ 148.443478][ T5319] blkdev_open+0x1d7/0x600 [ 148.445455][ T5319] do_dentry_open+0x816/0x1380 [ 148.447659][ T5319] vfs_open+0x3b/0x340 [ 148.449597][ T5319] path_openat+0x1443/0x1d60 [ 148.451648][ T5319] do_file_open+0x23e/0x4a0 [ 148.453601][ T5319] do_sys_openat2+0x115/0x200 [ 148.455774][ T5319] __x64_sys_openat+0x138/0x170 [ 148.457962][ T5319] do_syscall_64+0x166/0x520 [ 148.460506][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.463376][ T5319] [ 148.463376][ T5319] -> #0 (major_names_lock){+.+.}-{4:4}: [ 148.466727][ T5319] __lock_acquire+0x164c/0x2de0 [ 148.469068][ T5319] lock_acquire+0x115/0x350 [ 148.471305][ T5319] __mutex_lock+0x19d/0x1550 [ 148.473525][ T5319] blk_request_module+0x35/0x2a0 [ 148.476024][ T5319] blkdev_get_no_open+0x3f/0xe0 [ 148.478328][ T5319] bdev_file_open_by_dev+0xa0/0x240 [ 148.480759][ T5319] md_import_device+0x2e9/0x650 [ 148.482966][ T5319] md_add_new_disk+0x669/0x1850 [ 148.485231][ T5319] md_ioctl+0x200a/0x2610 [ 148.487276][ T5319] blkdev_ioctl+0x5e3/0x740 [ 148.489458][ T5319] __se_sys_ioctl+0xfc/0x170 [ 148.491700][ T5319] do_syscall_64+0x166/0x520 [ 148.493881][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.496565][ T5319] [ 148.496565][ T5319] other info that might help us debug this: [ 148.496565][ T5319] [ 148.500660][ T5319] Chain exists of: [ 148.500660][ T5319] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 148.500660][ T5319] [ 148.507069][ T5319] Possible unsafe locking scenario: [ 148.507069][ T5319] [ 148.510322][ T5319] CPU0 CPU1 [ 148.512624][ T5319] ---- ---- [ 148.514935][ T5319] lock(&mddev->reconfig_mutex); [ 148.517123][ T5319] lock((work_completion)(&mddev->sync_work)); [ 148.520861][ T5319] lock(&mddev->reconfig_mutex); [ 148.524013][ T5319] lock(major_names_lock); [ 148.525780][ T5319] [ 148.525780][ T5319] *** DEADLOCK *** [ 148.525780][ T5319] [ 148.529044][ T5319] locks held by syz.0.0/5319: 1, last CPU#0: [ 148.531510][ T5319] #0: ffff88803574c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 148.536210][ T5319] [ 148.536210][ T5319] stack backtrace: [ 148.538630][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 148.542360][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 148.546528][ T5319] Call Trace: [ 148.547967][ T5319] [ 148.549229][ T5319] dump_stack_lvl+0xe8/0x150 [ 148.551173][ T5319] print_circular_bug+0x2e2/0x300 [ 148.553313][ T5319] check_noncircular+0x12f/0x150 [ 148.555537][ T5319] __lock_acquire+0x164c/0x2de0 [ 148.557709][ T5319] ? post_alloc_hook+0x208/0x250 [ 148.559911][ T5319] ? get_page_from_freelist+0x2209/0x2280 [ 148.562314][ T5319] lock_acquire+0x115/0x350 [ 148.564341][ T5319] ? blk_request_module+0x35/0x2a0 [ 148.566477][ T5319] __mutex_lock+0x19d/0x1550 [ 148.568480][ T5319] ? blk_request_module+0x35/0x2a0 [ 148.570726][ T5319] ? lock_acquire+0x115/0x350 [ 148.572858][ T5319] ? blk_request_module+0x35/0x2a0 [ 148.574963][ T5319] ? __pfx___mutex_lock+0x10/0x10 [ 148.577262][ T5319] ? find_inode_fast+0x5dc/0x740 [ 148.579260][ T5319] ? find_inode_fast+0xd2/0x740 [ 148.581395][ T5319] blk_request_module+0x35/0x2a0 [ 148.583536][ T5319] blkdev_get_no_open+0x3f/0xe0 [ 148.585563][ T5319] bdev_file_open_by_dev+0xa0/0x240 [ 148.587676][ T5319] md_import_device+0x2e9/0x650 [ 148.589772][ T5319] md_add_new_disk+0x669/0x1850 [ 148.591953][ T5319] md_ioctl+0x200a/0x2610 [ 148.593886][ T5319] ? tomoyo_path_number_perm+0x219/0x5f0 [ 148.596346][ T5319] ? __pfx_md_ioctl+0x10/0x10 [ 148.598281][ T5319] ? do_vfs_ioctl+0x116f/0x1530 [ 148.600317][ T5319] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 148.602253][ T5319] ? hook_file_ioctl+0x1f2/0x600 [ 148.604256][ T5319] ? __pfx_md_ioctl+0x10/0x10 [ 148.606253][ T5319] blkdev_ioctl+0x5e3/0x740 [ 148.608252][ T5319] ? __pfx_blkdev_ioctl+0x10/0x10 [ 148.610393][ T5319] ? __fget_files+0x2a/0x420 [ 148.612385][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 148.614474][ T5319] ? __pfx_blkdev_ioctl+0x10/0x10 [ 148.616591][ T5319] __se_sys_ioctl+0xfc/0x170 [ 148.618586][ T5319] do_syscall_64+0x166/0x520 [ 148.620494][ T5319] ? trace_irq_disable+0x3b/0x140 [ 148.622711][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.625340][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 148.627300][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.629810][ T5319] RIP: 0033:0x7f03f779e159 [ 148.631670][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.639616][ T5319] RSP: 002b:00007f03f86a9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 148.643118][ T5319] RAX: ffffffffffffffda RBX: 00007f03f7a26090 RCX: 00007f03f779e159 [ 148.646284][ T5319] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 148.649620][ T5319] RBP: 00007f03f783506b R08: 0000000000000000 R09: 0000000000000000 [ 148.652902][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 148.656014][ T5319] R13: 00007f03f7a26128 R14: 00007f03f7a26090 R15: 00007ffe651e84f8 [ 148.659414][ T5319] [ 148.662291][ T5326] md: resync of RAID array md0 [ 148.671877][ T5326] md: md0: resync done. [ 148.694252][ T5319] block device autoloading is deprecated and will be removed. [ 148.695070][ T5327] md: recover of RAID array md0 [ 148.710235][ T5327] md: md0: recover done.