program: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f00000003c0)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x10, 0x4, &(0x7f0000000540)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x4f}], {0x95, 0x0, 0x700}}, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) ioctl(r1, 0x40140921, &(0x7f0000000480)) [ 103.232018][ T4664] Bluetooth: hci0: command tx timeout [ 103.511088][ T5351] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 103.511200][ T5351] block device autoloading is deprecated and will be removed. [ 103.531792][ T5351] [ 103.533567][ T5351] ====================================================== [ 103.538376][ T5351] WARNING: possible circular locking dependency detected [ 103.542312][ T5351] syzkaller #0 Not tainted [ 103.544934][ T5351] ------------------------------------------------------ [ 103.549074][ T5351] syz.0.0/5351 is trying to acquire lock: [ 103.551893][ T5351] ffffffff9096eba0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 103.556615][ T5351] [ 103.556615][ T5351] but task is already holding lock: [ 103.561076][ T5351] ffff888041e46358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.565854][ T5351] [ 103.565854][ T5351] which lock already depends on the new lock. [ 103.565854][ T5351] [ 103.570007][ T5351] [ 103.570007][ T5351] the existing dependency chain (in reverse order) is: [ 103.574241][ T5351] [ 103.574241][ T5351] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 103.577914][ T5351] __mutex_lock+0x197/0x15a0 [ 103.580650][ T5351] md_alloc+0x81e/0xf40 [ 103.583193][ T5351] md_alloc_and_put+0x1a/0x1f0 [ 103.586017][ T5351] add_named_array+0x240/0x350 [ 103.588747][ T5351] param_attr_store+0x214/0x310 [ 103.591707][ T5351] module_attr_store+0x65/0x90 [ 103.594538][ T5351] kernfs_fop_write_iter+0x3a4/0x540 [ 103.597341][ T5351] vfs_write+0x612/0xba0 [ 103.599471][ T5351] ksys_write+0x150/0x270 [ 103.602197][ T5351] do_syscall_64+0x16a/0x530 [ 103.605062][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.608555][ T5351] [ 103.608555][ T5351] -> #1 (disks_mutex){+.+.}-{4:4}: [ 103.612690][ T5351] __mutex_lock+0x197/0x15a0 [ 103.615691][ T5351] md_alloc+0x40/0xf40 [ 103.618457][ T5351] md_alloc_and_put+0x1a/0x1f0 [ 103.621614][ T5351] blk_request_module+0x27d/0x2a0 [ 103.624720][ T5351] blkdev_get_no_open+0x3f/0xe0 [ 103.627504][ T5351] blkdev_open+0x1d7/0x600 [ 103.630190][ T5351] do_dentry_open+0x80e/0x1360 [ 103.632904][ T5351] vfs_open_consume+0x4a/0x350 [ 103.635699][ T5351] path_openat+0x16fc/0x20f0 [ 103.638328][ T5351] do_file_open+0x23e/0x4a0 [ 103.641032][ T5351] do_sys_openat2+0x115/0x200 [ 103.643929][ T5351] __x64_sys_openat+0x138/0x170 [ 103.646677][ T5351] do_syscall_64+0x16a/0x530 [ 103.649443][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.654532][ T5351] [ 103.654532][ T5351] -> #0 (major_names_lock){+.+.}-{4:4}: [ 103.658290][ T5351] __lock_acquire+0x164c/0x2de0 [ 103.660690][ T5351] lock_acquire+0x115/0x350 [ 103.663336][ T5351] __mutex_lock+0x197/0x15a0 [ 103.665716][ T5351] blk_request_module+0x35/0x2a0 [ 103.667967][ T5351] blkdev_get_no_open+0x3f/0xe0 [ 103.670608][ T5351] bdev_file_open_by_dev+0xa0/0x240 [ 103.673453][ T5351] md_import_device+0x2e9/0x650 [ 103.676252][ T5351] md_add_new_disk+0x3a3/0x1850 [ 103.679155][ T5351] md_ioctl+0x2027/0x2630 [ 103.681835][ T5351] blkdev_ioctl+0x5e3/0x740 [ 103.684264][ T5351] __se_sys_ioctl+0xfc/0x170 [ 103.686677][ T5351] do_syscall_64+0x16a/0x530 [ 103.689387][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.692754][ T5351] [ 103.692754][ T5351] other info that might help us debug this: [ 103.692754][ T5351] [ 103.697899][ T5351] Chain exists of: [ 103.697899][ T5351] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 103.697899][ T5351] [ 103.704306][ T5351] Possible unsafe locking scenario: [ 103.704306][ T5351] [ 103.707272][ T5351] CPU0 CPU1 [ 103.710044][ T5351] ---- ---- [ 103.712870][ T5351] lock(&mddev->reconfig_mutex); [ 103.715676][ T5351] lock(disks_mutex); [ 103.719281][ T5351] lock(&mddev->reconfig_mutex); [ 103.723478][ T5351] lock(major_names_lock); [ 103.725746][ T5351] [ 103.725746][ T5351] *** DEADLOCK *** [ 103.725746][ T5351] [ 103.729201][ T5351] locks held by syz.0.0/5351: 1, on CPU#0: [ 103.732064][ T5351] #0: ffff888041e46358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.737362][ T5351] [ 103.737362][ T5351] stack backtrace: [ 103.740543][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.746179][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.751638][ T5351] Call Trace: [ 103.753445][ T5351] [ 103.755062][ T5351] dump_stack_lvl+0xe8/0x150 [ 103.757562][ T5351] print_circular_bug+0x2e2/0x300 [ 103.760708][ T5351] check_noncircular+0x12f/0x150 [ 103.763313][ T5351] __lock_acquire+0x164c/0x2de0 [ 103.766042][ T5351] ? post_alloc_hook+0x208/0x250 [ 103.768560][ T5351] ? get_page_from_freelist+0x2224/0x2290 [ 103.771372][ T5351] lock_acquire+0x115/0x350 [ 103.773324][ T5351] ? blk_request_module+0x35/0x2a0 [ 103.775476][ T5351] __mutex_lock+0x197/0x15a0 [ 103.777955][ T5351] ? blk_request_module+0x35/0x2a0 [ 103.780292][ T5351] ? lock_acquire+0x115/0x350 [ 103.782702][ T5351] ? blk_request_module+0x35/0x2a0 [ 103.784908][ T5351] ? __pfx___mutex_lock+0x10/0x10 [ 103.787099][ T5351] ? find_inode_fast+0x5dc/0x740 [ 103.789908][ T5351] ? find_inode_fast+0xd2/0x740 [ 103.792158][ T5351] blk_request_module+0x35/0x2a0 [ 103.794606][ T5351] blkdev_get_no_open+0x3f/0xe0 [ 103.796847][ T5351] bdev_file_open_by_dev+0xa0/0x240 [ 103.799531][ T5351] md_import_device+0x2e9/0x650 [ 103.801950][ T5351] md_add_new_disk+0x3a3/0x1850 [ 103.804557][ T5351] md_ioctl+0x2027/0x2630 [ 103.806659][ T5351] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.809562][ T5351] ? __pfx_md_ioctl+0x10/0x10 [ 103.811874][ T5351] ? do_vfs_ioctl+0x116f/0x1530 [ 103.813808][ T5351] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.816138][ T5351] ? do_futex+0x458/0x4e0 [ 103.818193][ T5351] ? __pfx_md_ioctl+0x10/0x10 [ 103.820334][ T5351] blkdev_ioctl+0x5e3/0x740 [ 103.822439][ T5351] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.824756][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.826977][ T5351] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.829350][ T5351] __se_sys_ioctl+0xfc/0x170 [ 103.831671][ T5351] do_syscall_64+0x16a/0x530 [ 103.833964][ T5351] ? trace_irq_disable+0x3b/0x140 [ 103.836464][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.839414][ T5351] ? clear_bhb_loop+0x70/0xc0 [ 103.841822][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.844298][ T5351] RIP: 0033:0x7fa92e79fb19 [ 103.846390][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.854696][ T5351] RSP: 002b:00007fa92f5bbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.858001][ T5351] RAX: ffffffffffffffda RBX: 00007fa92ea26090 RCX: 00007fa92e79fb19 [ 103.861830][ T5351] RDX: 0000200000000480 RSI: 0000000040140921 RDI: 0000000000000005 [ 103.866362][ T5351] RBP: 00007fa92e837b70 R08: 0000000000000000 R09: 0000000000000000 [ 103.870452][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.874481][ T5351] R13: 00007fa92ea26128 R14: 00007fa92ea26090 R15: 00007ffd048a4d48 [ 103.879362][ T5351] [ 103.885034][ T5350] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 103.969626][ T5351] md: could not open device unknown-block(4,1344). [ 103.969676][ T5351] md: md_import_device returned -6