program: r0 = gettid() r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000dc0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000e00)) timer_settime(0x0, 0x0, &(0x7f0000000e40)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_int(r2, 0x1, 0x10, 0x0, &(0x7f0000000e80)) mknodat$md(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x6180, 0x0) r3 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000240)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r3, 0x40480923, &(0x7f0000000280)={0x0, 0x5a, 0x0, 0x0, 0xfffffffffff0bdc0, 0xebf, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x10000}) ioctl$ADD_NEW_DISK(r3, 0x40140921, &(0x7f0000000300)={0x0, {0x1, 0x0}, 0x0, 0x6}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='0\n', 0x2) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-sm4-aesni-avx\x00'}, 0x58) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x3, &(0x7f0000000c00)=ANY=[@ANYBLOB="1800000005000000000000000000000095"], &(0x7f0000000c40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c80)={r6, 0xe0, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000ef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, 0xa, 0x8, 0x0, 0x0}}, 0x7) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000001c0)="0123456789abcdef0123456789abcdef", 0x10) r7 = accept4$alg(r5, 0x0, 0x0, 0x0) r8 = syz_open_dev$media(&(0x7f0000000980), 0x3, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc0287c02, &(0x7f00000009c0)={0x80000000, &(0x7f0000000a00), 0x0}) sendmsg$alg(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000680)='\x00'/128, 0x80}], 0x1, &(0x7f0000000700)=[@assoc={0x18, 0x117, 0x4, 0x8}], 0x18, 0x10000000}, 0x4080) read$alg(r7, &(0x7f0000000740)=""/128, 0x80) ioctl$ADD_NEW_DISK(r3, 0x40140921, &(0x7f0000000340)={0x1, {0x1, 0x1}, 0x1, 0x6}) ioctl$RUN_ARRAY(r3, 0x400c0930, &(0x7f0000000380)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a31000000001400038008"], 0x138}, 0x1, 0x0, 0x0, 0x200448c5}, 0x0) [ 126.395826][ T5347] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 126.396922][ T5347] block device autoloading is deprecated and will be removed. [ 126.403915][ T49] Bluetooth: hci0: command tx timeout [ 126.460580][ T5347] [ 126.461681][ T5347] ====================================================== [ 126.464656][ T5347] WARNING: possible circular locking dependency detected [ 126.467682][ T5347] syzkaller #0 Not tainted [ 126.469638][ T5347] ------------------------------------------------------ [ 126.472596][ T5347] syz.0.0/5347 is trying to acquire lock: [ 126.475071][ T5347] ffffffff9096eba0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 126.479536][ T5347] [ 126.479536][ T5347] but task is already holding lock: [ 126.482691][ T5347] ffff888038fd2358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 126.489305][ T5347] [ 126.489305][ T5347] which lock already depends on the new lock. [ 126.489305][ T5347] [ 126.493676][ T5347] [ 126.493676][ T5347] the existing dependency chain (in reverse order) is: [ 126.497390][ T5347] [ 126.497390][ T5347] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 126.501003][ T5347] __mutex_lock+0x197/0x15a0 [ 126.503399][ T5347] md_alloc+0x81e/0xf40 [ 126.505434][ T5347] md_alloc_and_put+0x1a/0x1f0 [ 126.507796][ T5347] blk_request_module+0x27d/0x2a0 [ 126.510235][ T5347] blkdev_get_no_open+0x3f/0xe0 [ 126.512798][ T5347] blkdev_open+0x1d7/0x600 [ 126.515289][ T5347] do_dentry_open+0x80e/0x1360 [ 126.517514][ T5347] vfs_open_consume+0x4a/0x350 [ 126.519598][ T5347] path_openat+0x16fc/0x20f0 [ 126.521681][ T5347] do_file_open+0x23e/0x4a0 [ 126.523731][ T5347] do_sys_openat2+0x115/0x200 [ 126.525883][ T5347] __x64_sys_openat+0x138/0x170 [ 126.528203][ T5347] do_syscall_64+0x16a/0x530 [ 126.530329][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.533189][ T5347] [ 126.533189][ T5347] -> #1 (disks_mutex){+.+.}-{4:4}: [ 126.536507][ T5347] __mutex_lock+0x197/0x15a0 [ 126.538829][ T5347] md_alloc+0x40/0xf40 [ 126.540915][ T5347] md_alloc_and_put+0x1a/0x1f0 [ 126.543094][ T5347] blk_request_module+0x27d/0x2a0 [ 126.545397][ T5347] blkdev_get_no_open+0x3f/0xe0 [ 126.547668][ T5347] blkdev_open+0x1d7/0x600 [ 126.549843][ T5347] do_dentry_open+0x80e/0x1360 [ 126.552195][ T5347] vfs_open_consume+0x4a/0x350 [ 126.554544][ T5347] path_openat+0x16fc/0x20f0 [ 126.556782][ T5347] do_file_open+0x23e/0x4a0 [ 126.558900][ T5347] do_sys_openat2+0x115/0x200 [ 126.561131][ T5347] __x64_sys_openat+0x138/0x170 [ 126.563460][ T5347] do_syscall_64+0x16a/0x530 [ 126.565721][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.568389][ T5347] [ 126.568389][ T5347] -> #0 (major_names_lock){+.+.}-{4:4}: [ 126.571798][ T5347] __lock_acquire+0x164c/0x2de0 [ 126.574268][ T5347] lock_acquire+0x115/0x350 [ 126.576388][ T5347] __mutex_lock+0x197/0x15a0 [ 126.578629][ T5347] blk_request_module+0x35/0x2a0 [ 126.580980][ T5347] blkdev_get_no_open+0x3f/0xe0 [ 126.583149][ T5347] bdev_file_open_by_dev+0xa0/0x240 [ 126.585569][ T5347] md_import_device+0x2e9/0x650 [ 126.587896][ T5347] md_add_new_disk+0x522/0x1850 [ 126.590288][ T5347] md_ioctl+0x2027/0x2630 [ 126.592440][ T5347] blkdev_ioctl+0x5e3/0x740 [ 126.594827][ T5347] __se_sys_ioctl+0xfc/0x170 [ 126.596984][ T5347] do_syscall_64+0x16a/0x530 [ 126.599286][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.602132][ T5347] [ 126.602132][ T5347] other info that might help us debug this: [ 126.602132][ T5347] [ 126.606689][ T5347] Chain exists of: [ 126.606689][ T5347] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 126.606689][ T5347] [ 126.612525][ T5347] Possible unsafe locking scenario: [ 126.612525][ T5347] [ 126.615798][ T5347] CPU0 CPU1 [ 126.618104][ T5347] ---- ---- [ 126.620394][ T5347] lock(&mddev->reconfig_mutex); [ 126.622384][ T5347] lock(disks_mutex); [ 126.625216][ T5347] lock(&mddev->reconfig_mutex); [ 126.628348][ T5347] lock(major_names_lock); [ 126.630267][ T5347] [ 126.630267][ T5347] *** DEADLOCK *** [ 126.630267][ T5347] [ 126.633753][ T5347] locks held by syz.0.0/5347: 1, on CPU#0: [ 126.636406][ T5347] #0: ffff888038fd2358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 126.641062][ T5347] [ 126.641062][ T5347] stack backtrace: [ 126.643621][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 126.647673][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.652611][ T5347] Call Trace: [ 126.654196][ T5347] [ 126.655590][ T5347] dump_stack_lvl+0xe8/0x150 [ 126.657702][ T5347] print_circular_bug+0x2e2/0x300 [ 126.659959][ T5347] check_noncircular+0x12f/0x150 [ 126.662088][ T5347] __lock_acquire+0x164c/0x2de0 [ 126.664437][ T5347] ? post_alloc_hook+0x208/0x250 [ 126.666670][ T5347] ? get_page_from_freelist+0x2224/0x2290 [ 126.669229][ T5347] lock_acquire+0x115/0x350 [ 126.671290][ T5347] ? blk_request_module+0x35/0x2a0 [ 126.673619][ T5347] __mutex_lock+0x197/0x15a0 [ 126.675710][ T5347] ? blk_request_module+0x35/0x2a0 [ 126.678077][ T5347] ? lock_acquire+0x115/0x350 [ 126.680191][ T5347] ? blk_request_module+0x35/0x2a0 [ 126.682545][ T5347] ? __pfx___mutex_lock+0x10/0x10 [ 126.685304][ T5347] ? find_inode_fast+0x5dc/0x740 [ 126.687794][ T5347] ? find_inode_fast+0xd2/0x740 [ 126.690192][ T5347] blk_request_module+0x35/0x2a0 [ 126.692460][ T5347] blkdev_get_no_open+0x3f/0xe0 [ 126.694690][ T5347] bdev_file_open_by_dev+0xa0/0x240 [ 126.697236][ T5347] md_import_device+0x2e9/0x650 [ 126.699721][ T5347] md_add_new_disk+0x522/0x1850 [ 126.701968][ T5347] md_ioctl+0x2027/0x2630 [ 126.703931][ T5347] ? tomoyo_path_number_perm+0x219/0x5f0 [ 126.706423][ T5347] ? __pfx_md_ioctl+0x10/0x10 [ 126.708026][ T5347] ? do_vfs_ioctl+0x116f/0x1530 [ 126.709585][ T5347] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 126.711205][ T5347] ? vfs_read+0x676/0xa80 [ 126.712590][ T5347] ? do_futex+0x3e7/0x4e0 [ 126.713981][ T5347] ? __pfx_md_ioctl+0x10/0x10 [ 126.715539][ T5347] blkdev_ioctl+0x5e3/0x740 [ 126.717345][ T5347] ? __pfx_blkdev_ioctl+0x10/0x10 [ 126.719390][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20 [ 126.721171][ T5347] ? __pfx_blkdev_ioctl+0x10/0x10 [ 126.723158][ T5347] __se_sys_ioctl+0xfc/0x170 [ 126.725197][ T5347] do_syscall_64+0x16a/0x530 [ 126.727203][ T5347] ? trace_irq_disable+0x3b/0x140 [ 126.729453][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.732035][ T5347] ? clear_bhb_loop+0x70/0xc0 [ 126.734128][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.736529][ T5347] RIP: 0033:0x7f5f0b99fb19 [ 126.738290][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.746440][ T5347] RSP: 002b:00007f5f0c7a1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 126.749977][ T5347] RAX: ffffffffffffffda RBX: 00007f5f0bc26090 RCX: 00007f5f0b99fb19 [ 126.753214][ T5347] RDX: 0000200000000340 RSI: 0000000040140921 RDI: 0000000000000004 [ 126.756349][ T5347] RBP: 00007f5f0ba37b70 R08: 0000000000000000 R09: 0000000000000000 [ 126.759972][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.763402][ T5347] R13: 00007f5f0bc26128 R14: 00007f5f0bc26090 R15: 00007ffe7dfb4f78 [ 126.766860][ T5347] [ 126.835622][ T5347] md: could not open device unknown-block(0,0). [ 126.835730][ T5347] md: error, md_import_device() returned -6