qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x17e000) [ 67.037526][ T1134] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 67.037548][ T1134] ata1: failed to read log page 10h (errno=-5) [ 67.037563][ T1134] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 67.037578][ T1134] ata1.00: irq_stat 0x41000000 [ 67.037592][ T1134] ata1.00: failed command: WRITE FPDMA QUEUED [ 67.037601][ T1134] ata1.00: cmd 61/f0:70:86:87:04/0b:00:00:00:00/40 tag 14 ncq dma 1564672 ou [ 67.037601][ T1134] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 67.037646][ T1134] ata1.00: status: { DRDY } [ 67.037660][ T1134] ata1.00: failed command: WRITE FPDMA QUEUED [ 67.037668][ T1134] ata1.00: cmd 61/f0:78:76:93:04/12:00:00:00:00/40 tag 15 ncq dma 2482176 ou [ 67.037668][ T1134] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 67.037713][ T1134] ata1.00: status: { DRDY } [ 67.038684][ T1134] ata1.00: configured for UDMA/100 [ 67.039038][ T1134] ata1: EH complete Warning: Permanently added '[localhost]:34903' (ED25519) to the list of known hosts. [+] Reproducer for circular locking dependency in array_state_store starting... [*] === Starting reproduction cycle: mA=10, mB=11, mC=12, loop_minor=20, md_probe_minor=21 === [+] mknod /dev/md10 successful. [+] open /dev/md10 successful (fd=3). [ 67.255953][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.256039][ T6108] block device autoloading is deprecated and will be removed. [+] ioctl SET_ARRAY_INFO successful on md10. [*] ioctl ADD_NEW_DISK (loop minor 20) returned: Invalid argument (expected for probe) [ 67.377314][ T6108] md: loop20 has zero or unknown size, marking faulty! [ 67.377377][ T6108] md: error, md_import_device() returned -22 [*] ioctl ADD_NEW_DISK (md minor 21) returned: Invalid argument (expected for probe) [+] ioctl STOP_ARRAY successful on md10. [+] close fdA successful. [+] mknod /dev/md11 successful. [ 67.443938][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.443959][ T6108] block device autoloading is deprecated and will be removed. [ 67.444114][ T6108] md: md21 has zero or unknown size, marking faulty! [ 67.444147][ T6108] md: error, md_import_device() returned -22 [ 67.444370][ T6108] md: md10 stopped. [+] open /dev/md11 successful (fd=3). [+] Found sysfs attribute /sys/block/md11/md/array_state. [ 67.505612][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [+] Started 8 hammer threads on /sys/block/md11/md/array_state. [+] ioctl STOP_ARRAY successful on md11. [+] close fdB successful, del_work queued to md_misc_wq. [+] mknod /dev/md12 successful. [ 67.505631][ T6108] block device autoloading is deprecated and will be removed. [ 67.511737][ T6108] md: md11 stopped. [+] open /dev/md12 successful (fd=3). [+] Joined all hammer threads. [+] open /sys/block/md12/md/array_state successful (sfd=4). [*] Writing 'inactive' to /sys/block/md12/md/array_state to trigger lockdep... [+] write 'inactive' successful (bytes=9). [ 67.524771][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [*] Writing 'clean' to /sys/block/md12/md/array_state... [*] write 'clean' returned: Invalid argument [*] Writing 'clear' to /sys/block/md12/md/array_state... [+] write 'clear' successful (bytes=6). [+] close sfd successful. [+] ioctl STOP_ARRAY successful on md12. [ 67.524787][ T6108] block device autoloading is deprecated and will be removed. [+] close fdC successful. [ 67.530938][ T6108] md: md12 stopped. [ 67.532350][ T6108] md: md12 stopped. [+] Cycle mA=10, mB=11, mC=12 complete. [*] === Starting reproduction cycle: mA=13, mB=14, mC=15, loop_minor=22, md_probe_minor=23 === [+] mknod /dev/md13 successful. [+] open /dev/md13 successful (fd=3). [ 67.607398][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.607412][ T6108] block device autoloading is deprecated and will be removed. [+] ioctl SET_ARRAY_INFO successful on md13. [*] ioctl ADD_NEW_DISK (loop minor 22) returned: Invalid argument (expected for probe) [ 67.716653][ T6108] md: loop22 has zero or unknown size, marking faulty! [ 67.716689][ T6108] md: error, md_import_device() returned -22 [*] ioctl ADD_NEW_DISK (md minor 23) returned: Invalid argument (expected for probe) [+] ioctl STOP_ARRAY successful on md13. [+] close fdA successful. [+] mknod /dev/md14 successful. [ 67.784561][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.784575][ T6108] block device autoloading is deprecated and will be removed. [ 67.784624][ T6108] md: md23 has zero or unknown size, marking faulty! [ 67.784655][ T6108] md: error, md_import_device() returned -22 [ 67.784914][ T6108] md: md13 stopped. [+] open /dev/md14 successful (fd=3). [+] Found sysfs attribute /sys/block/md14/md/array_state. [+] Started 8 hammer threads on /sys/block/md14/md/array_state. [+] ioctl STOP_ARRAY successful on md14. [+] close fdB successful, del_work queued to md_misc_wq. [+] mknod /dev/md15 successful. [ 67.836705][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.836718][ T6108] block device autoloading is deprecated and will be removed. [ 67.845656][ T6108] md: md14 stopped. [+] open /dev/md15 successful (fd=3). [ 67.854979][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [+] Joined all hammer threads. [ 67.854991][ T6108] block device autoloading is deprecated and will be removed. [+] open /sys/block/md15/md/array_state successful (sfd=4). [*] Writing 'inactive' to /sys/block/md15/md/array_state to trigger lockdep... [+] write 'inactive' successful (bytes=9). [*] Writing 'clean' to /sys/block/md15/md/array_state... [*] write 'clean' returned: Invalid argument [*] Writing 'clear' to /sys/block/md15/md/array_state... [+] write 'clear' successful (bytes=6). [+] close sfd successful. [+] ioctl STOP_ARRAY successful on md15. [+] close fdC successful. [+] Cycle mA=13, mB=14, mC=15 complete. [*] === Starting reproduction cycle: mA=16, mB=17, mC=18, loop_minor=24, md_probe_minor=25 === [+] mknod /dev/md16 successful. [ 67.864477][ T6108] md: md15 stopped. [ 67.864768][ T6108] md: md15 stopped. [+] open /dev/md16 successful (fd=3). [ 67.916718][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 67.916737][ T6108] block device autoloading is deprecated and will be removed. [+] ioctl SET_ARRAY_INFO successful on md16. [*] ioctl ADD_NEW_DISK (loop minor 24) returned: Invalid argument (expected for probe) [ 68.026698][ T6108] md: loop24 has zero or unknown size, marking faulty! [ 68.026734][ T6108] md: error, md_import_device() returned -22 [*] ioctl ADD_NEW_DISK (md minor 25) returned: Invalid argument (expected for probe) [+] ioctl STOP_ARRAY successful on md16. [+] close fdA successful. [+] mknod /dev/md17 successful. [ 68.074867][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.074886][ T6108] block device autoloading is deprecated and will be removed. [ 68.074952][ T6108] md: md25 has zero or unknown size, marking faulty! [ 68.075004][ T6108] md: error, md_import_device() returned -22 [ 68.075414][ T6108] md: md16 stopped. [+] open /dev/md17 successful (fd=3). [+] Found sysfs attribute /sys/block/md17/md/array_state. [ 68.095533][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [+] Started 8 hammer threads on /sys/block/md17/md/array_state. [+] ioctl STOP_ARRAY successful on md17. [+] close fdB successful, del_work queued to md_misc_wq. [+] mknod /dev/md18 successful. [ 68.110256][ T6108] md: md17 stopped. [+] open /dev/md18 successful (fd=3). [ 68.119288][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.120524][ T10] [ 68.124325][ T10] ====================================================== [ 68.126492][ T10] WARNING: possible circular locking dependency detected [ 68.128751][ T10] syzkaller #0 Not tainted [ 68.130182][ T10] ------------------------------------------------------ [ 68.132331][ T10] kworker/0:1/10 is trying to acquire lock: [ 68.134166][ T10] ffff88805d50ff08 (kn->active#67){++++}-{0:0}, at: __kernfs_remove+0x34c/0xbc0 [ 68.136949][ T10] [ 68.136949][ T10] but task is already holding lock: [ 68.139395][ T10] ffffc900001c7d08 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 68.142872][ T10] [ 68.142872][ T10] which lock already depends on the new lock. [ 68.142872][ T10] [ 68.146082][ T10] [ 68.146082][ T10] the existing dependency chain (in reverse order) is: [ 68.148893][ T10] [ 68.148893][ T10] -> #4 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}: [ 68.151863][ T10] lock_acquire+0x1d1/0x380 [ 68.153530][ T10] process_one_work+0xa32/0x1b10 [ 68.155525][ T10] worker_thread+0x5ef/0xe50 [ 68.157285][ T10] kthread+0x373/0x450 [ 68.158757][ T10] ret_from_fork+0x730/0xd60 [ 68.160417][ T10] ret_from_fork_asm+0x1a/0x30 [ 68.162059][ T10] [ 68.162059][ T10] -> #3 ((wq_completion)md_misc){+.+.}-{0:0}: [ 68.164609][ T10] lock_acquire+0x1d1/0x380 [ 68.166220][ T10] touch_wq_lockdep_map+0xad/0x1c0 [ 68.168091][ T10] __flush_workqueue+0x131/0x1200 [ 68.169809][ T10] md_alloc+0x30/0x10a0 [ 68.171279][ T10] md_probe+0x73/0xf0 [ 68.172879][ T10] blk_probe_dev+0x149/0x1e0 [ 68.174592][ T10] blk_request_module+0x16/0xc0 [ 68.176270][ T10] blkdev_get_no_open+0x9b/0xf0 [ 68.178072][ T10] blkdev_open+0x141/0x4f0 [ 68.179610][ T10] do_dentry_open+0x674/0x1470 [ 68.181385][ T10] vfs_open_consume+0xcc/0x460 [ 68.183121][ T10] path_openat+0x1547/0x23f0 [ 68.184751][ T10] do_file_open+0x20e/0x430 [ 68.186380][ T10] do_sys_openat2+0x163/0x1d0 [ 68.188046][ T10] __ia32_compat_sys_openat+0x12d/0x210 [ 68.189955][ T10] __do_fast_syscall_32+0x14b/0x8c0 [ 68.191766][ T10] do_fast_syscall_32+0x32/0x70 [ 68.193479][ T10] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.195678][ T10] [ 68.195678][ T10] -> #2 (major_names_lock){+.+.}-{4:4}: [ 68.198134][ T10] lock_acquire+0x1d1/0x380 [ 68.199757][ T10] __mutex_lock+0x19f/0x1c10 [ 68.201551][ T10] blk_probe_dev+0x28/0x1e0 [ 68.203254][ T10] blk_request_module+0x16/0xc0 [ 68.205061][ T10] blkdev_get_no_open+0x9b/0xf0 [ 68.206750][ T10] bdev_file_open_by_dev+0x70/0x210 [ 68.208607][ T10] md_import_device+0x120/0x360 [ 68.210293][ T10] md_add_new_disk+0xdbf/0x1820 [ 68.212012][ T10] md_ioctl+0x2be7/0x36c0 [ 68.213587][ T10] compat_blkdev_ioctl+0x682/0x7b0 [ 68.215345][ T10] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 68.217232][ T10] __do_fast_syscall_32+0x14b/0x8c0 [ 68.219053][ T10] do_fast_syscall_32+0x32/0x70 [ 68.220813][ T10] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.223010][ T10] [ 68.223010][ T10] -> #1 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 68.225826][ T10] lock_acquire+0x1d1/0x380 [ 68.227451][ T10] __mutex_lock+0x19f/0x1c10 [ 68.229100][ T10] array_state_store+0x174/0xcf0 [ 68.230835][ T10] md_attr_store+0x1c5/0x330 [ 68.232448][ T10] sysfs_kf_write+0xf2/0x150 [ 68.234102][ T10] kernfs_fop_write_iter+0x3e0/0x5f0 [ 68.235931][ T10] vfs_write+0x6af/0x1050 [ 68.237305][ T10] ksys_pwrite64+0x161/0x1a0 [ 68.238879][ T10] do_int80_emulation+0x166/0x650 [ 68.240621][ T10] asm_int80_emulation+0x1a/0x20 [ 68.242363][ T10] [ 68.242363][ T10] -> #0 (kn->active#67){++++}-{0:0}: [ 68.244897][ T10] check_prev_add+0xeb/0xe60 [ 68.246506][ T10] __lock_acquire+0x1528/0x1f40 [ 68.248545][ T10] lock_acquire+0x1d1/0x380 [ 68.250116][ T10] kernfs_drain+0x4eb/0x600 [ 68.251698][ T10] __kernfs_remove+0x34c/0xbc0 [ 68.253399][ T10] kernfs_remove_by_name_ns+0x7c/0x120 [ 68.255228][ T10] remove_files+0x96/0x1c0 [ 68.256805][ T10] sysfs_remove_group+0x8b/0x1b0 [ 68.258492][ T10] sysfs_remove_groups+0x60/0xb0 [ 68.260404][ T10] __kobject_del+0x89/0x220 [ 68.262033][ T10] kobject_put+0x348/0x640 [ 68.263643][ T10] process_one_work+0xac7/0x1b10 [ 68.265393][ T10] worker_thread+0x5ef/0xe50 [ 68.267041][ T10] kthread+0x373/0x450 [ 68.268488][ T10] ret_from_fork+0x730/0xd60 [ 68.270083][ T10] ret_from_fork_asm+0x1a/0x30 [ 68.271737][ T10] [ 68.271737][ T10] other info that might help us debug this: [ 68.271737][ T10] [ 68.275090][ T10] Chain exists of: [ 68.275090][ T10] kn->active#67 --> (wq_completion)md_misc --> (work_completion)(&mddev->del_work) [ 68.275090][ T10] [ 68.279766][ T10] Possible unsafe locking scenario: [ 68.279766][ T10] [ 68.282053][ T10] CPU0 CPU1 [ 68.284047][ T10] ---- ---- [ 68.285750][ T10] lock((work_completion)(&mddev->del_work)); [ 68.287721][ T10] lock((wq_completion)md_misc); [ 68.290031][ T10] lock((work_completion)(&mddev->del_work)); [ 68.292708][ T10] lock(kn->active#67); [ 68.294139][ T10] [ 68.294139][ T10] *** DEADLOCK *** [ 68.294139][ T10] [ 68.296628][ T10] locks held by kworker/0:1/10: 2, last CPU#0: [ 68.298601][ T10] #0: ffff8880220a9148 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 [ 68.301935][ T10] #1: ffffc900001c7d08 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 68.305661][ T10] [ 68.305661][ T10] stack backtrace: [ 68.307640][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 68.310509][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.313840][ T10] Workqueue: md_misc mddev_delayed_delete [ 68.315709][ T10] Call Trace: [ 68.316801][ T10] [ 68.317774][ T10] dump_stack_lvl+0x100/0x190 [ 68.319312][ T10] print_circular_bug.cold+0x178/0x1be [ 68.321040][ T10] check_noncircular+0x146/0x160 [ 68.322610][ T10] check_prev_add+0xeb/0xe60 [ 68.324107][ T10] __lock_acquire+0x1528/0x1f40 [ 68.325679][ T10] lock_acquire+0x1d1/0x380 [ 68.327330][ T10] ? __kernfs_remove+0x34c/0xbc0 [ 68.329003][ T10] ? kernfs_drain+0x4c2/0x600 [ 68.330484][ T10] kernfs_drain+0x4eb/0x600 [ 68.331912][ T10] ? __kernfs_remove+0x34c/0xbc0 [ 68.333749][ T10] ? __pfx_kernfs_drain+0x10/0x10 [ 68.335356][ T10] ? find_held_lock+0x2b/0x80 [ 68.336884][ T10] ? __kernfs_remove+0x224/0xbc0 [ 68.338465][ T10] ? __kernfs_remove+0x224/0xbc0 [ 68.340031][ T10] ? up_write+0x2dc/0x5b0 [ 68.341413][ T10] __kernfs_remove+0x34c/0xbc0 [ 68.342947][ T10] kernfs_remove_by_name_ns+0x7c/0x120 [ 68.344686][ T10] remove_files+0x96/0x1c0 [ 68.346107][ T10] sysfs_remove_group+0x8b/0x1b0 [ 68.347718][ T10] sysfs_remove_groups+0x60/0xb0 [ 68.349368][ T10] __kobject_del+0x89/0x220 [ 68.351220][ T10] kobject_put+0x348/0x640 [ 68.352797][ T10] process_one_work+0xac7/0x1b10 [ 68.354596][ T10] ? __pfx_process_one_work+0x10/0x10 [ 68.356658][ T10] ? lock_acquire+0x1d1/0x380 [ 68.358556][ T10] ? __pfx_mddev_delayed_delete+0x10/0x10 [ 68.360549][ T10] worker_thread+0x5ef/0xe50 [ 68.362325][ T10] ? __pfx_worker_thread+0x10/0x10 [ 68.364265][ T10] ? kthread+0x13a/0x450 [ 68.365941][ T10] ? __pfx_worker_thread+0x10/0x10 [ 68.367937][ T10] kthread+0x373/0x450 [ 68.369500][ T10] ? __pfx_kthread+0x10/0x10 [ 68.371258][ T10] ret_from_fork+0x730/0xd60 [ 68.372779][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 68.374596][ T10] ? __switch_to+0x800/0x10e0 [ 68.376172][ T10] ? __pfx_kthread+0x10/0x10 [ 68.377628][ T10] ret_from_fork_asm+0x1a/0x30 [ 68.379360][ T10] [+] Joined all hammer threads. [+] open /sys/block/md18/md/array_state successful (sfd=4). [*] Writing 'inactive' to /sys/block/md18/md/array_state to trigger lockdep... [+] write 'inactive' successful (bytes=9). [*] Writing 'clean' to /sys/block/md18/md/array_state... [*] write 'clean' returned: Invalid argument [*] Writing 'clear' to /sys/block/md18/md/array_state... [+] write 'clear' successful (bytes=6). [+] close sfd successful. [+] ioctl STOP_ARRAY successful on md18. [+] close fdC successful. [+] Cycle mA=16, mB=17, mC=18 complete. [*] === Starting reproduction cycle: mA=19, mB=20, mC=21, loop_minor=26, md_probe_minor=27 === [+] mknod /dev/md19 successful. [ 68.381357][ T6108] md: md18 stopped. [ 68.381496][ T6108] md: md18 stopped. [+] open /dev/md19 successful (fd=3). [ 68.461960][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [+] ioctl SET_ARRAY_INFO successful on md19. [*] ioctl ADD_NEW_DISK (loop minor 26) returned: Invalid argument (expected for probe) [ 68.566652][ T6108] md: loop26 has zero or unknown size, marking faulty! [ 68.566697][ T6108] md: error, md_import_device() returned -22 [*] ioctl ADD_NEW_DISK (md minor 27) returned: Invalid argument (expected for probe) [+] ioctl STOP_ARRAY successful on md19. [+] close fdA successful. [+] mknod /dev/md20 successful. [ 68.608681][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.608713][ T6108] md: md27 has zero or unknown size, marking faulty! [ 68.608774][ T6108] md: error, md_import_device() returned -22 [ 68.608927][ T6108] md: md19 stopped. [+] open /dev/md20 successful (fd=3). [+] Found sysfs attribute /sys/block/md20/md/array_state. [+] Started 8 hammer threads on /sys/block/md20/md/array_state. [+] ioctl STOP_ARRAY successful on md20. [+] close fdB successful, del_work queued to md_misc_wq. [ 68.648958][ T6108] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.656223][ T6108] md: md20 stopped. [+] mknod /dev/md21 successful. [+] open /dev/md21 successful (fd=11). [+] Joined all hammer threads. [+] open /sys/block/md21/md/array_state successful (sfd=3). [*] Writing 'inactive' to /sys/block/md21/md/array_state to trigger lockdep... [+] write 'inactive' successful (bytes=9). [*] Writing 'clean' to /sys/block/md21/md/array_state... [*] write 'clean' returned: Invalid argument [*] Writing 'clear' to /sys/block/md21/md/array_state... [+] write 'clear' successful (bytes=6). [+] close sfd successful. [+] ioctl STOP_ARRAY successful on md21. [+] close fdC successful. [+] Cycle mA=19, mB=20, mC=21 complete. [+] All cycles finished, waiting for kernel lockdep asynchronous report... [ 68.675225][ T6108] md: md21 stopped. [ 68.675434][ T6108] md: md21 stopped. [+] Reproducer completed. [ 71.137439][ T1446] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.137465][ T1446] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.258978][ T50] cfg80211: failed to load regulatory.db