program: io_uring_setup(0x115a, &(0x7f0000000440)={0x0, 0x4ef1, 0x40, 0x0, 0x4d5}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2049,proto=udp,vers=3,mountport=2049,mountproto=udp,soft,timeo=1,retrans=1\x00') connect$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYBLOB="010000000200"]) ioctl$sock_bt_bnep_BNEPCONNDEL(r3, 0x400442c9, &(0x7f0000000100)={0x0, @broadcast}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$KVM_GET_PIT2(r5, 0x8070ae9f, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100") [ 94.442786][ T4645] Bluetooth: hci0: command tx timeout [ 94.637728][ T5319] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.641538][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.641658][ T5324] block device autoloading is deprecated and will be removed. [ 94.789423][ T5319] md/raid10:md0: not clean -- starting background reconstruction [ 94.789438][ T5319] md/raid10:md0: active with 1 out of 2 devices [ 94.790853][ T5319] md0: detected capacity change from 0 to 2048 [ 94.817480][ T5328] md: resync of RAID array md0 [ 94.918102][ T5328] md: md0: resync done. [ 94.994056][ T5318] [ 94.995178][ T5318] ====================================================== [ 94.998933][ T5318] WARNING: possible circular locking dependency detected [ 95.002749][ T5318] syzkaller #0 Not tainted [ 95.005266][ T5318] ------------------------------------------------------ [ 95.009011][ T5318] syz.0.0/5318 is trying to acquire lock: [ 95.012040][ T5318] ffffffff8f555740 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 95.016090][ T5318] [ 95.016090][ T5318] but task is already holding lock: [ 95.019163][ T5318] ffff888037804358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.023518][ T5318] [ 95.023518][ T5318] which lock already depends on the new lock. [ 95.023518][ T5318] [ 95.027870][ T5318] [ 95.027870][ T5318] the existing dependency chain (in reverse order) is: [ 95.031563][ T5318] [ 95.031563][ T5318] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 95.035116][ T5318] __mutex_lock+0x19d/0x1550 [ 95.037375][ T5318] md_start_sync+0x179/0x1010 [ 95.039611][ T5318] process_scheduled_works+0xc3d/0x1630 [ 95.042070][ T5318] worker_thread+0xa47/0xfb0 [ 95.044175][ T5318] kthread+0x38b/0x480 [ 95.046124][ T5318] ret_from_fork+0x514/0xb70 [ 95.048265][ T5318] ret_from_fork_asm+0x1a/0x30 [ 95.050590][ T5318] [ 95.050590][ T5318] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 95.054471][ T5318] process_scheduled_works+0xc03/0x1630 [ 95.057044][ T5318] worker_thread+0xa47/0xfb0 [ 95.059336][ T5318] kthread+0x38b/0x480 [ 95.061304][ T5318] ret_from_fork+0x514/0xb70 [ 95.063560][ T5318] ret_from_fork_asm+0x1a/0x30 [ 95.065867][ T5318] [ 95.065867][ T5318] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 95.069289][ T5318] touch_wq_lockdep_map+0xcb/0x180 [ 95.071629][ T5318] __flush_workqueue+0x148/0x1470 [ 95.073974][ T5318] md_alloc+0x32/0xf20 [ 95.075930][ T5318] md_alloc_and_put+0x1a/0x1f0 [ 95.078136][ T5318] blk_request_module+0x27d/0x2a0 [ 95.080408][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.082766][ T5318] blkdev_open+0x1d7/0x600 [ 95.084592][ T5318] do_dentry_open+0x816/0x1380 [ 95.086841][ T5318] vfs_open+0x3b/0x340 [ 95.088749][ T5318] path_openat+0x1443/0x1d60 [ 95.090831][ T5318] do_file_open+0x23e/0x4a0 [ 95.093022][ T5318] do_sys_openat2+0x115/0x200 [ 95.095192][ T5318] __x64_sys_openat+0x138/0x170 [ 95.097604][ T5318] do_syscall_64+0x166/0x520 [ 95.099806][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.102466][ T5318] [ 95.102466][ T5318] -> #0 (major_names_lock){+.+.}-{4:4}: [ 95.105602][ T5318] __lock_acquire+0x164c/0x2de0 [ 95.107771][ T5318] lock_acquire+0x115/0x350 [ 95.109925][ T5318] __mutex_lock+0x19d/0x1550 [ 95.112103][ T5318] blk_request_module+0x35/0x2a0 [ 95.114386][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.116670][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 95.119219][ T5318] md_import_device+0x2e9/0x650 [ 95.121460][ T5318] md_add_new_disk+0x669/0x1850 [ 95.123657][ T5318] md_ioctl+0x1fe4/0x2610 [ 95.125600][ T5318] blkdev_ioctl+0x5e3/0x740 [ 95.127623][ T5318] __se_sys_ioctl+0xfc/0x170 [ 95.129672][ T5318] do_syscall_64+0x166/0x520 [ 95.131762][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.134480][ T5318] [ 95.134480][ T5318] other info that might help us debug this: [ 95.134480][ T5318] [ 95.138757][ T5318] Chain exists of: [ 95.138757][ T5318] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 95.138757][ T5318] [ 95.145054][ T5318] Possible unsafe locking scenario: [ 95.145054][ T5318] [ 95.148098][ T5318] CPU0 CPU1 [ 95.150406][ T5318] ---- ---- [ 95.152743][ T5318] lock(&mddev->reconfig_mutex); [ 95.154989][ T5318] lock((work_completion)(&mddev->sync_work)); [ 95.158742][ T5318] lock(&mddev->reconfig_mutex); [ 95.162084][ T5318] lock(major_names_lock); [ 95.164010][ T5318] [ 95.164010][ T5318] *** DEADLOCK *** [ 95.164010][ T5318] [ 95.167439][ T5318] locks held by syz.0.0/5318: 1, last CPU#0: [ 95.169991][ T5318] #0: ffff888037804358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 95.174573][ T5318] [ 95.174573][ T5318] stack backtrace: [ 95.177101][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.181164][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.185271][ T5318] Call Trace: [ 95.186699][ T5318] [ 95.187975][ T5318] dump_stack_lvl+0xe8/0x150 [ 95.189893][ T5318] print_circular_bug+0x2e2/0x300 [ 95.192011][ T5318] check_noncircular+0x12f/0x150 [ 95.194309][ T5318] __lock_acquire+0x164c/0x2de0 [ 95.196390][ T5318] ? post_alloc_hook+0x208/0x250 [ 95.198542][ T5318] ? get_page_from_freelist+0x2209/0x2280 [ 95.201088][ T5318] lock_acquire+0x115/0x350 [ 95.203092][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.205268][ T5318] __mutex_lock+0x19d/0x1550 [ 95.207257][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.209562][ T5318] ? lock_acquire+0x115/0x350 [ 95.211515][ T5318] ? blk_request_module+0x35/0x2a0 [ 95.213739][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 95.215922][ T5318] ? find_inode_fast+0x5dc/0x740 [ 95.218193][ T5318] ? find_inode_fast+0xd2/0x740 [ 95.220385][ T5318] blk_request_module+0x35/0x2a0 [ 95.222641][ T5318] blkdev_get_no_open+0x3f/0xe0 [ 95.224846][ T5318] bdev_file_open_by_dev+0xa0/0x240 [ 95.227205][ T5318] md_import_device+0x2e9/0x650 [ 95.229293][ T5318] md_add_new_disk+0x669/0x1850 [ 95.231357][ T5318] md_ioctl+0x1fe4/0x2610 [ 95.233132][ T5318] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.235445][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 95.237350][ T5318] ? do_vfs_ioctl+0x116f/0x1530 [ 95.239392][ T5318] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.241511][ T5318] ? hook_file_ioctl+0x1f2/0x600 [ 95.243598][ T5318] ? __pfx_md_ioctl+0x10/0x10 [ 95.245643][ T5318] blkdev_ioctl+0x5e3/0x740 [ 95.247601][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.249773][ T5318] ? __fget_files+0x2a/0x420 [ 95.251725][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.253761][ T5318] ? __pfx_blkdev_ioctl+0x10/0x10 [ 95.255870][ T5318] __se_sys_ioctl+0xfc/0x170 [ 95.257869][ T5318] do_syscall_64+0x166/0x520 [ 95.259932][ T5318] ? trace_irq_disable+0x3b/0x140 [ 95.262130][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.264580][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 95.266601][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.269260][ T5318] RIP: 0033:0x7f5930f9e159 [ 95.271190][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.279479][ T5318] RSP: 002b:00007f5931da3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.283418][ T5318] RAX: ffffffffffffffda RBX: 00007f5931225fa0 RCX: 00007f5930f9e159 [ 95.287642][ T5318] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004 [ 95.290909][ T5318] RBP: 00007f593103506b R08: 0000000000000000 R09: 0000000000000000 [ 95.294182][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.297591][ T5318] R13: 00007f5931226038 R14: 00007f5931225fa0 R15: 00007ffd0f01f508 [ 95.301622][ T5318] [ 95.370403][ T5318] block device autoloading is deprecated and will be removed. [ 95.371962][ T5335] md: recover of RAID array md0 [ 95.371983][ T5335] md: md0: recover done.