program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001")
ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006")
ioctl(r1, 0x400c0930, 0x0)
ioctl(r1, 0x40140921, &(0x7f0000000440)) (fail_nth: 13)
[ 102.293080][ T4636] Bluetooth: hci0: command tx timeout
[ 102.454982][ T5315] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 102.463667][ T5314] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 102.469005][ T5315] block device autoloading is deprecated and will be removed.
[ 102.634413][ T5314] md/raid10:md0: not clean -- starting background reconstruction
[ 102.640046][ T5314] md/raid10:md0: active with 1 out of 2 devices
[ 102.646906][ T5314] md0: detected capacity change from 0 to 2048
[ 102.690439][ T5315] FAULT_INJECTION: forcing a failure.
[ 102.690439][ T5315] name failslab, interval 1, probability 0, space 0, times 1
[ 102.695953][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.695971][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.695978][ T5315] Call Trace:
[ 102.695983][ T5315]
[ 102.695988][ T5315] dump_stack_lvl+0xe8/0x150
[ 102.696055][ T5315] should_fail_ex+0x410/0x560
[ 102.696105][ T5315] should_failslab+0xa8/0x100
[ 102.696119][ T5315] __kmalloc_node_track_caller_noprof+0x100/0x740
[ 102.696131][ T5315] ? __kasan_kmalloc+0x93/0xb0
[ 102.696144][ T5315] ? __request_module+0x2ec/0x630
[ 102.696155][ T5315] ? __request_module+0x2ec/0x630
[ 102.696169][ T5315] kstrdup+0x42/0x100
[ 102.696203][ T5315] __request_module+0x2ec/0x630
[ 102.696213][ T5315] ? blk_request_module+0x125/0x2a0
[ 102.696227][ T5315] ? __pfx___request_module+0x10/0x10
[ 102.696235][ T5315] ? __mutex_unlock_slowpath+0x731/0x900
[ 102.696283][ T5315] ? find_inode_fast+0xd2/0x740
[ 102.696302][ T5315] blk_request_module+0x16b/0x2a0
[ 102.696316][ T5315] blkdev_get_no_open+0x3f/0xe0
[ 102.696333][ T5315] bdev_file_open_by_dev+0xa0/0x240
[ 102.696348][ T5315] md_import_device+0x2e9/0x650
[ 102.696365][ T5315] md_add_new_disk+0x669/0x1850
[ 102.696382][ T5315] md_ioctl+0x1fbc/0x2580
[ 102.696399][ T5315] ? tomoyo_path_number_perm+0x219/0x5f0
[ 102.696412][ T5315] ? __pfx_md_ioctl+0x10/0x10
[ 102.696427][ T5315] ? do_vfs_ioctl+0x116f/0x1530
[ 102.696443][ T5315] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 102.696465][ T5315] ? hook_file_ioctl+0x1f0/0x5f0
[ 102.696489][ T5315] ? __pfx_md_ioctl+0x10/0x10
[ 102.696504][ T5315] blkdev_ioctl+0x5e3/0x740
[ 102.696522][ T5315] ? __pfx_blkdev_ioctl+0x10/0x10
[ 102.696530][ T5315] ? __fget_files+0x2a/0x420
[ 102.696545][ T5315] ? bpf_lsm_file_ioctl+0x9/0x20
[ 102.696555][ T5315] ? __pfx_blkdev_ioctl+0x10/0x10
[ 102.696565][ T5315] __se_sys_ioctl+0xfc/0x170
[ 102.696582][ T5315] do_syscall_64+0x166/0x520
[ 102.696595][ T5315] ? trace_irq_disable+0x3b/0x140
[ 102.696609][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.696619][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 102.696632][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.696643][ T5315] RIP: 0033:0x7fdcb259e0d9
[ 102.696654][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.696663][ T5315] RSP: 002b:00007fdcb34c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 102.696677][ T5315] RAX: ffffffffffffffda RBX: 00007fdcb2826090 RCX: 00007fdcb259e0d9
[ 102.696684][ T5315] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000004
[ 102.696690][ T5315] RBP: 00007fdcb34c8050 R08: 0000000000000000 R09: 0000000000000000
[ 102.696696][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 102.696701][ T5315] R13: 00007fdcb2826128 R14: 00007fdcb2826090 R15: 00007ffc53d849c8
[ 102.696717][ T5315]
[ 102.696850][ T5315] md: could not open device unknown-block(0,0).
[ 102.839617][ T5315] md: md_import_device returned -6
[ 102.843341][ T9]
[ 102.844469][ T9] ======================================================
[ 102.847005][ T9] WARNING: possible circular locking dependency detected
[ 102.849680][ T9] syzkaller #0 Not tainted
[ 102.851545][ T9] ------------------------------------------------------
[ 102.854556][ T9] kworker/0:0/9 is trying to acquire lock:
[ 102.857105][ T9] ffff88801d182358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: md_start_sync+0xf7/0xdc0
[ 102.861231][ T9]
[ 102.861231][ T9] but task is already holding lock:
[ 102.864263][ T9] ffffc9000022fc40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0
[ 102.869242][ T9]
[ 102.869242][ T9] which lock already depends on the new lock.
[ 102.869242][ T9]
[ 102.873575][ T9]
[ 102.873575][ T9] the existing dependency chain (in reverse order) is:
[ 102.877388][ T9]
[ 102.877388][ T9] -> #3 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}:
[ 102.881469][ T9] process_scheduled_works+0xa52/0x14c0
[ 102.884177][ T9] worker_thread+0xa47/0xfb0
[ 102.886367][ T9] kthread+0x38b/0x480
[ 102.888529][ T9] ret_from_fork+0x514/0xb70
[ 102.890783][ T9] ret_from_fork_asm+0x1a/0x30
[ 102.892991][ T9]
[ 102.892991][ T9] -> #2 ((wq_completion)md_misc){+.+.}-{0:0}:
[ 102.896292][ T9] touch_wq_lockdep_map+0xcb/0x180
[ 102.898657][ T9] __flush_workqueue+0x148/0x1470
[ 102.900897][ T9] md_alloc+0x32/0xf20
[ 102.902762][ T9] md_alloc_and_put+0x1a/0x1f0
[ 102.905089][ T9] blk_request_module+0x27d/0x2a0
[ 102.907523][ T9] blkdev_get_no_open+0x3f/0xe0
[ 102.909713][ T9] blkdev_open+0x1d7/0x600
[ 102.911799][ T9] do_dentry_open+0x816/0x1380
[ 102.914228][ T9] vfs_open+0x3b/0x340
[ 102.916272][ T9] path_openat+0x1443/0x1d60
[ 102.918514][ T9] do_file_open+0x23e/0x4a0
[ 102.920571][ T9] do_sys_openat2+0x115/0x200
[ 102.922663][ T9] __x64_sys_openat+0x138/0x170
[ 102.924900][ T9] do_syscall_64+0x166/0x520
[ 102.927035][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.929977][ T9]
[ 102.929977][ T9] -> #1 (major_names_lock){+.+.}-{4:4}:
[ 102.933516][ T9] __mutex_lock+0x19d/0x1550
[ 102.935760][ T9] blk_request_module+0x35/0x2a0
[ 102.938076][ T9] blkdev_get_no_open+0x3f/0xe0
[ 102.940276][ T9] bdev_file_open_by_dev+0xa0/0x240
[ 102.942682][ T9] md_import_device+0x2e9/0x650
[ 102.944997][ T9] md_add_new_disk+0x669/0x1850
[ 102.947235][ T9] md_ioctl+0x1fbc/0x2580
[ 102.949214][ T9] blkdev_ioctl+0x5e3/0x740
[ 102.951432][ T9] __se_sys_ioctl+0xfc/0x170
[ 102.953479][ T9] do_syscall_64+0x166/0x520
[ 102.955642][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.958275][ T9]
[ 102.958275][ T9] -> #0 (&mddev->reconfig_mutex){+.+.}-{4:4}:
[ 102.961421][ T9] __lock_acquire+0x1520/0x2cf0
[ 102.963614][ T9] lock_acquire+0x106/0x350
[ 102.965741][ T9] __mutex_lock+0x19d/0x1550
[ 102.967860][ T9] md_start_sync+0xf7/0xdc0
[ 102.969929][ T9] process_scheduled_works+0xa88/0x14c0
[ 102.972538][ T9] worker_thread+0xa47/0xfb0
[ 102.974712][ T9] kthread+0x38b/0x480
[ 102.976622][ T9] ret_from_fork+0x514/0xb70
[ 102.978844][ T9] ret_from_fork_asm+0x1a/0x30
[ 102.981038][ T9]
[ 102.981038][ T9] other info that might help us debug this:
[ 102.981038][ T9]
[ 102.985331][ T9] Chain exists of:
[ 102.985331][ T9] &mddev->reconfig_mutex --> (wq_completion)md_misc --> (work_completion)(&mddev->sync_work)
[ 102.985331][ T9]
[ 102.992002][ T9] Possible unsafe locking scenario:
[ 102.992002][ T9]
[ 102.995210][ T9] CPU0 CPU1
[ 102.997470][ T9] ---- ----
[ 102.999744][ T9] lock((work_completion)(&mddev->sync_work));
[ 103.002168][ T9] lock((wq_completion)md_misc);
[ 103.005097][ T9] lock((work_completion)(&mddev->sync_work));
[ 103.008793][ T9] lock(&mddev->reconfig_mutex);
[ 103.010946][ T9]
[ 103.010946][ T9] *** DEADLOCK ***
[ 103.010946][ T9]
[ 103.014151][ T9] locks held by kworker/0:0/9: 2, last CPU#0:
[ 103.017703][ T9] #0: ffff88801f943940 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0
[ 103.022031][ T9] #1: ffffc9000022fc40 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0
[ 103.026712][ T9]
[ 103.026712][ T9] stack backtrace:
[ 103.029041][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.029056][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.029080][ T9] Workqueue: md_misc md_start_sync
[ 103.029105][ T9] Call Trace:
[ 103.029202][ T9]
[ 103.029209][ T9] dump_stack_lvl+0xe8/0x150
[ 103.029225][ T9] print_circular_bug+0x2e1/0x300
[ 103.029239][ T9] check_noncircular+0x12e/0x150
[ 103.029251][ T9] __lock_acquire+0x1520/0x2cf0
[ 103.029265][ T9] ? unwind_next_frame+0x1baf/0x2550
[ 103.029315][ T9] ? deref_stack_reg+0x18e/0x220
[ 103.029324][ T9] ? unwind_next_frame+0x8f/0x2550
[ 103.029333][ T9] ? unwind_next_frame+0x1baf/0x2550
[ 103.029343][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 103.029356][ T9] ? unwind_next_frame+0x8f/0x2550
[ 103.029366][ T9] ? md_start_sync+0xf7/0xdc0
[ 103.029375][ T9] lock_acquire+0x106/0x350
[ 103.029387][ T9] ? md_start_sync+0xf7/0xdc0
[ 103.029399][ T9] __mutex_lock+0x19d/0x1550
[ 103.029483][ T9] ? md_start_sync+0xf7/0xdc0
[ 103.029495][ T9] ? check_path+0x21/0x40
[ 103.029505][ T9] ? md_start_sync+0xf7/0xdc0
[ 103.029515][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 103.029527][ T9] ? md_spares_need_change+0x1c/0x240
[ 103.029540][ T9] ? md_spares_need_change+0x1c/0x240
[ 103.029555][ T9] md_start_sync+0xf7/0xdc0
[ 103.029624][ T9] ? __pfx_md_start_sync+0x10/0x10
[ 103.029637][ T9] ? rcu_is_watching+0x16/0xb0
[ 103.029647][ T9] ? process_scheduled_works+0xa1a/0x14c0
[ 103.029659][ T9] process_scheduled_works+0xa88/0x14c0
[ 103.029674][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.029686][ T9] ? assign_work+0x3cf/0x5d0
[ 103.029697][ T9] worker_thread+0xa47/0xfb0
[ 103.029714][ T9] kthread+0x38b/0x480
[ 103.029727][ T9] ? __pfx_worker_thread+0x10/0x10
[ 103.029738][ T9] ? __pfx_kthread+0x10/0x10
[ 103.029751][ T9] ret_from_fork+0x514/0xb70
[ 103.029767][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 103.029780][ T9] ? __switch_to+0xc89/0x1420
[ 103.029794][ T9] ? __pfx_kthread+0x10/0x10
[ 103.029806][ T9] ret_from_fork_asm+0x1a/0x30
[ 103.029823][ T9]