program: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r0}, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x19, 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="2363d8b44edadf0b2d83cd078937db951d833d6b5b493853064dd129e016c30457e09f51c6bb5d2c51b90e4476c83a75c766c7cb1c098478fcc357ba9fa9e4f4db6546d0f78f576c7544a380bef152eaaaf9ca3d23ba8e962fe5e08607dfadcfd1b9678777d0780e8127ecb45b552af9816b1991154476a3bd77e4ad6bcf79ca8b21ce5cd98785673dbcf34b086bad32cf5fd069c0fa061e447bb8d8113cbc1a8a8cd89774aa90914e8ecbe93c81862b8c7640980067464ddaa4d27030c9ef4769fde60e75a0130b4e363e1fb831a525d644d1b84087cce8f9f4c620f9c6acd240c6"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r3, 0xd, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='md0\n', 0x4) close(0xffffffffffffffff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r5, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r5, 0x40140921, 0x0) ioctl(r5, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r5, 0x400c0930, &(0x7f0000000500)='\x00\x00\x00') ioctl(r5, 0x40140921, &(0x7f0000000440)='\x00\x00\x00\x00\x00') mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)="93d0fee46ae8c0d63ca38bfa0eeb6360b2b4a7fb89639b8774efb0379c63bf45e43fca503ea25d38813279dc2f96936760040790291b48c802300351256c77759625fa370dceb6b9703cb95c7b0b671b522dc4ce1cf4e3d92ce04f64a86649cd0ede203025a0db455f7b2ca63d2c5d3c216baf171ef1b7fa90ca5eb03e83eb224c7abae2edb393274c82cc8253f29ce109767e9f8ddb1243397c43df93bc588c9d0000000000003532f69ce442d7e9f191120c9bda4450416e3ad99ea0cba46d04030443dd38da702acaf1519797686aef7f8f5922cb5dca34ff2b1da829b5982bf4d3ffa85823e7a0379240d7a39218d0674a2dc86cc2b186b9c55e947c60df5da9903030b3a25c694d82af7b0503576aa471d32bbe52168b2040eef907989040a7d07852285de4da6e5a2c804f6022e444dc9521766144668e95b555eb8412058b975e86078354715f4197", 0x14c) write(r7, &(0x7f0000000100)='100', 0x3) r8 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r8, 0x65, 0x4, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040)=0x4, 0x21) socket$inet(0x2, 0x4000000000000001, 0x0) [ 87.818374][ T9] cfg80211: failed to load regulatory.db [ 88.089789][ T5304] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 88.094556][ T5305] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 88.097905][ T5305] block device autoloading is deprecated and will be removed. [ 88.184834][ T5269] Bluetooth: hci0: command tx timeout qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xb5000) [ 88.280816][ T1022] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 88.283911][ T1022] ata1: failed to read log page 10h (errno=-5) [ 88.286765][ T1022] ata1.00: exception Emask 0x1 SAct 0x6000 SErr 0x0 action 0x0 [ 88.290540][ T1022] ata1.00: irq_stat 0x41000008 [ 88.292696][ T1022] ata1.00: failed command: WRITE FPDMA QUEUED [ 88.295472][ T1022] ata1.00: cmd 61/78:68:d6:19:08/05:00:00:00:00/40 tag 13 ncq dma 716800 out [ 88.295472][ T1022] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 88.302932][ T1022] ata1.00: status: { DRDY } [ 88.304666][ T1022] ata1.00: error: { ABRT } [ 88.306358][ T1022] ata1.00: failed command: WRITE FPDMA QUEUED [ 88.308792][ T1022] ata1.00: cmd 61/a8:70:4e:1f:08/05:00:00:00:00/40 tag 14 ncq dma 741376 out [ 88.308792][ T1022] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 88.317702][ T1022] ata1.00: status: { DRDY } [ 88.320269][ T1022] ata1.00: error: { ABRT } [ 88.323463][ T1022] ata1.00: configured for UDMA/100 [ 88.326183][ T1022] ata1: EH complete [ 88.398124][ T5304] md/raid10:md0: not clean -- starting background reconstruction [ 88.415009][ T5304] md/raid10:md0: active with 1 out of 2 devices [ 88.423377][ T5304] md0: detected capacity change from 0 to 2048 [ 88.512912][ T5305] md: could not open device unknown-block(0,0). [ 88.515913][ T5305] md: md_import_device returned -6 [ 88.518527][ T805] [ 88.519569][ T805] ====================================================== [ 88.522523][ T805] WARNING: possible circular locking dependency detected [ 88.525565][ T805] syzkaller #0 Not tainted [ 88.527489][ T805] ------------------------------------------------------ [ 88.530521][ T805] kworker/0:2/805 is trying to acquire lock: [ 88.533051][ T805] ffff88803482a358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_start_sync+0x179/0x1010 [ 88.537026][ T805] [ 88.537026][ T805] but task is already holding lock: [ 88.540212][ T805] ffffc900040efc40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 88.545291][ T805] [ 88.545291][ T805] which lock already depends on the new lock. [ 88.545291][ T805] [ 88.549599][ T805] [ 88.549599][ T805] the existing dependency chain (in reverse order) is: [ 88.553534][ T805] [ 88.553534][ T805] -> #3 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 88.557639][ T805] process_scheduled_works+0xc03/0x1630 [ 88.560340][ T805] worker_thread+0xa47/0xfb0 [ 88.562620][ T805] kthread+0x38b/0x480 [ 88.564679][ T805] ret_from_fork+0x514/0xb70 [ 88.567124][ T805] ret_from_fork_asm+0x1a/0x30 [ 88.569683][ T805] [ 88.569683][ T805] -> #2 ((wq_completion)md_misc){+.+.}-{0:0}: [ 88.573233][ T805] touch_wq_lockdep_map+0xcb/0x180 [ 88.575672][ T805] __flush_workqueue+0x148/0x1470 [ 88.578088][ T805] md_alloc+0x32/0xf20 [ 88.580567][ T805] md_alloc_and_put+0x1a/0x1f0 [ 88.583146][ T805] blk_request_module+0x27d/0x2a0 [ 88.585660][ T805] blkdev_get_no_open+0x3f/0xe0 [ 88.587909][ T805] blkdev_open+0x1d7/0x600 [ 88.589880][ T805] do_dentry_open+0x816/0x1380 [ 88.591960][ T805] vfs_open+0x3b/0x340 [ 88.593845][ T805] path_openat+0x1443/0x1d60 [ 88.596006][ T805] do_file_open+0x23e/0x4a0 [ 88.598051][ T805] do_sys_openat2+0x115/0x200 [ 88.600105][ T805] __x64_sys_openat+0x138/0x170 [ 88.602406][ T805] do_syscall_64+0x166/0x520 [ 88.604565][ T805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.607256][ T805] [ 88.607256][ T805] -> #1 (major_names_lock){+.+.}-{4:4}: [ 88.610574][ T805] __mutex_lock+0x19d/0x1550 [ 88.612811][ T805] blk_request_module+0x35/0x2a0 [ 88.615172][ T805] blkdev_get_no_open+0x3f/0xe0 [ 88.617504][ T805] bdev_file_open_by_dev+0xa0/0x240 [ 88.620012][ T805] md_import_device+0x2e9/0x650 [ 88.622357][ T805] md_add_new_disk+0x669/0x1850 [ 88.624667][ T805] md_ioctl+0x200a/0x2610 [ 88.626850][ T805] blkdev_ioctl+0x5e3/0x740 [ 88.628984][ T805] __se_sys_ioctl+0xfc/0x170 [ 88.631180][ T805] do_syscall_64+0x166/0x520 [ 88.633396][ T805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.636151][ T805] [ 88.636151][ T805] -> #0 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 88.639658][ T805] __lock_acquire+0x1520/0x2cf0 [ 88.642004][ T805] lock_acquire+0x106/0x350 [ 88.644178][ T805] __mutex_lock+0x19d/0x1550 [ 88.646419][ T805] md_start_sync+0x179/0x1010 [ 88.648627][ T805] process_scheduled_works+0xc3d/0x1630 [ 88.651207][ T805] worker_thread+0xa47/0xfb0 [ 88.653443][ T805] kthread+0x38b/0x480 [ 88.655419][ T805] ret_from_fork+0x514/0xb70 [ 88.657672][ T805] ret_from_fork_asm+0x1a/0x30 [ 88.660002][ T805] [ 88.660002][ T805] other info that might help us debug this: [ 88.660002][ T805] [ 88.664278][ T805] Chain exists of: [ 88.664278][ T805] &mddev->reconfig_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->sync_work) [ 88.664278][ T805] [ 88.670998][ T805] Possible unsafe locking scenario: [ 88.670998][ T805] [ 88.674171][ T805] CPU0 CPU1 [ 88.676416][ T805] ---- ---- [ 88.678720][ T805] lock((work_completion)(&mddev->sync_work)); [ 88.681359][ T805] lock((wq_completion)md_misc); [ 88.684548][ T805] lock((work_completion)(&mddev->sync_work)); [ 88.688244][ T805] lock(&mddev->reconfig_mutex); [ 88.690381][ T805] [ 88.690381][ T805] *** DEADLOCK *** [ 88.690381][ T805] [ 88.693767][ T805] locks held by kworker/0:2/805: 2, last CPU#0: [ 88.696239][ T805] #0: ffff888000188d40 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 88.700531][ T805] #1: ffffc900040efc40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 88.705332][ T805] [ 88.705332][ T805] stack backtrace: [ 88.707690][ T805] CPU: 0 UID: 0 PID: 805 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 88.707704][ T805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.707712][ T805] Workqueue: md_misc md_start_sync [ 88.707730][ T805] Call Trace: [ 88.707736][ T805] [ 88.707742][ T805] dump_stack_lvl+0xe8/0x150 [ 88.707758][ T805] print_circular_bug+0x2e1/0x300 [ 88.707771][ T805] check_noncircular+0x12e/0x150 [ 88.707782][ T805] __lock_acquire+0x1520/0x2cf0 [ 88.707797][ T805] ? unwind_next_frame+0x1baf/0x2550 [ 88.707807][ T805] ? deref_stack_reg+0x18e/0x220 [ 88.707817][ T805] ? unwind_next_frame+0x8f/0x2550 [ 88.707826][ T805] ? unwind_next_frame+0x1baf/0x2550 [ 88.707836][ T805] ? ret_from_fork_asm+0x1a/0x30 [ 88.707850][ T805] ? unwind_next_frame+0x8f/0x2550 [ 88.707859][ T805] ? md_start_sync+0x179/0x1010 [ 88.707869][ T805] lock_acquire+0x106/0x350 [ 88.707882][ T805] ? md_start_sync+0x179/0x1010 [ 88.707895][ T805] __mutex_lock+0x19d/0x1550 [ 88.707907][ T805] ? md_start_sync+0x179/0x1010 [ 88.707918][ T805] ? check_path+0x21/0x40 [ 88.707928][ T805] ? md_start_sync+0x179/0x1010 [ 88.707938][ T805] ? __pfx___mutex_lock+0x10/0x10 [ 88.707950][ T805] ? md_spares_need_change+0x1c/0x240 [ 88.707965][ T805] ? md_spares_need_change+0x1c/0x240 [ 88.707979][ T805] md_start_sync+0x179/0x1010 [ 88.707991][ T805] ? __pfx_md_start_sync+0x10/0x10 [ 88.708002][ T805] ? rcu_is_watching+0x16/0xb0 [ 88.708011][ T805] ? process_scheduled_works+0x97a/0x1630 [ 88.708023][ T805] process_scheduled_works+0xc3d/0x1630 [ 88.708040][ T805] ? __pfx_process_scheduled_works+0x10/0x10 [ 88.708051][ T805] ? assign_work+0x3cf/0x5d0 [ 88.708062][ T805] worker_thread+0xa47/0xfb0 [ 88.708079][ T805] kthread+0x38b/0x480 [ 88.708092][ T805] ? __pfx_worker_thread+0x10/0x10 [ 88.708102][ T805] ? __pfx_kthread+0x10/0x10 [ 88.708115][ T805] ret_from_fork+0x514/0xb70 [ 88.708130][ T805] ? __pfx_ret_from_fork+0x10/0x10 [ 88.708142][ T805] ? __switch_to+0xc89/0x1420 [ 88.708155][ T805] ? __pfx_kthread+0x10/0x10 [ 88.708168][ T805] ret_from_fork_asm+0x1a/0x30 [ 88.708184][ T805]