program: io_uring_setup(0x70fa, &(0x7f0000000440)={0x0, 0xffc0, 0x4000, 0x400001, 0x2e0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) read$FUSE(r0, &(0x7f00000004c0)={0x2020}, 0x2020) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/tcp_syncookies\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") syslog(0x4, &(0x7f0000000040), 0x0) ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)="020000000100") [ 92.680757][ T5280] Bluetooth: hci0: command tx timeout [ 92.701768][ T9] cfg80211: failed to load regulatory.db [ 92.865386][ T5316] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 92.869464][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 92.869595][ T5317] block device autoloading is deprecated and will be removed. [ 92.973250][ T5316] md/raid10:md0: not clean -- starting background reconstruction [ 92.973265][ T5316] md/raid10:md0: active with 1 out of 2 devices [ 92.975032][ T5316] md0: detected capacity change from 0 to 2048 [ 92.997086][ T5317] [ 92.998112][ T5317] ====================================================== [ 93.000983][ T5317] WARNING: possible circular locking dependency detected [ 93.003873][ T5317] syzkaller #0 Not tainted [ 93.005830][ T5317] ------------------------------------------------------ [ 93.009018][ T5317] syz.0.0/5317 is trying to acquire lock: [ 93.011525][ T5317] ffffffff8f556b80 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 93.015804][ T5317] [ 93.015804][ T5317] but task is already holding lock: [ 93.019076][ T5317] ffff88803131c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 93.023683][ T5317] [ 93.023683][ T5317] which lock already depends on the new lock. [ 93.023683][ T5317] [ 93.027934][ T5317] [ 93.027934][ T5317] the existing dependency chain (in reverse order) is: [ 93.031874][ T5317] [ 93.031874][ T5317] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 93.035319][ T5317] __mutex_lock+0x19d/0x1550 [ 93.037650][ T5317] md_start_sync+0x179/0x1010 [ 93.039938][ T5317] process_scheduled_works+0xc3d/0x1630 [ 93.042659][ T5317] worker_thread+0xa47/0xfb0 [ 93.044973][ T5317] kthread+0x38b/0x480 [ 93.046996][ T5317] ret_from_fork+0x514/0xb70 [ 93.051966][ T5317] ret_from_fork_asm+0x1a/0x30 [ 93.054426][ T5317] [ 93.054426][ T5317] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 93.058534][ T5317] process_scheduled_works+0xc03/0x1630 [ 93.061269][ T5317] worker_thread+0xa47/0xfb0 [ 93.063371][ T5317] kthread+0x38b/0x480 [ 93.065465][ T5317] ret_from_fork+0x514/0xb70 [ 93.067703][ T5317] ret_from_fork_asm+0x1a/0x30 [ 93.069889][ T5317] [ 93.069889][ T5317] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 93.073363][ T5317] touch_wq_lockdep_map+0xcb/0x180 [ 93.075851][ T5317] __flush_workqueue+0x148/0x1470 [ 93.078793][ T5317] md_alloc+0x32/0xf20 [ 93.081160][ T5317] md_alloc_and_put+0x1a/0x1f0 [ 93.083528][ T5317] blk_request_module+0x27d/0x2a0 [ 93.085993][ T5317] blkdev_get_no_open+0x3f/0xe0 [ 93.088409][ T5317] blkdev_open+0x1d7/0x600 [ 93.090554][ T5317] do_dentry_open+0x816/0x1380 [ 93.092860][ T5317] vfs_open+0x3b/0x340 [ 93.094844][ T5317] path_openat+0x1443/0x1d60 [ 93.096995][ T5317] do_file_open+0x23e/0x4a0 [ 93.099102][ T5317] do_sys_openat2+0x115/0x200 [ 93.101255][ T5317] __x64_sys_openat+0x138/0x170 [ 93.103461][ T5317] do_syscall_64+0x166/0x520 [ 93.105701][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.108438][ T5317] [ 93.108438][ T5317] -> #0 (major_names_lock){+.+.}-{4:4}: [ 93.111710][ T5317] __lock_acquire+0x164c/0x2de0 [ 93.114108][ T5317] lock_acquire+0x115/0x350 [ 93.116479][ T5317] __mutex_lock+0x19d/0x1550 [ 93.118774][ T5317] blk_request_module+0x35/0x2a0 [ 93.121061][ T5317] blkdev_get_no_open+0x3f/0xe0 [ 93.123300][ T5317] bdev_file_open_by_dev+0xa0/0x240 [ 93.125559][ T5317] md_import_device+0x2e9/0x650 [ 93.127577][ T5317] md_add_new_disk+0x669/0x1850 [ 93.129433][ T5317] md_ioctl+0x200a/0x2610 [ 93.131129][ T5317] blkdev_ioctl+0x5e3/0x740 [ 93.133524][ T5317] __se_sys_ioctl+0xfc/0x170 [ 93.135866][ T5317] do_syscall_64+0x166/0x520 [ 93.138054][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.140494][ T5317] [ 93.140494][ T5317] other info that might help us debug this: [ 93.140494][ T5317] [ 93.144441][ T5317] Chain exists of: [ 93.144441][ T5317] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 93.144441][ T5317] [ 93.150640][ T5317] Possible unsafe locking scenario: [ 93.150640][ T5317] [ 93.153754][ T5317] CPU0 CPU1 [ 93.155923][ T5317] ---- ---- [ 93.158369][ T5317] lock(&mddev->reconfig_mutex); [ 93.160535][ T5317] lock((work_completion)(&mddev->sync_work)); [ 93.163993][ T5317] lock(&mddev->reconfig_mutex); [ 93.166916][ T5317] lock(major_names_lock); [ 93.168833][ T5317] [ 93.168833][ T5317] *** DEADLOCK *** [ 93.168833][ T5317] [ 93.172369][ T5317] locks held by syz.0.0/5317: 1, last CPU#0: [ 93.175041][ T5317] #0: ffff88803131c358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 93.179689][ T5317] [ 93.179689][ T5317] stack backtrace: [ 93.182291][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.186288][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.190503][ T5317] Call Trace: [ 93.191980][ T5317] [ 93.193297][ T5317] dump_stack_lvl+0xe8/0x150 [ 93.195387][ T5317] print_circular_bug+0x2e2/0x300 [ 93.197642][ T5317] check_noncircular+0x12f/0x150 [ 93.199898][ T5317] __lock_acquire+0x164c/0x2de0 [ 93.202002][ T5317] ? post_alloc_hook+0x208/0x250 [ 93.204048][ T5317] ? get_page_from_freelist+0x2209/0x2280 [ 93.206416][ T5317] lock_acquire+0x115/0x350 [ 93.208373][ T5317] ? blk_request_module+0x35/0x2a0 [ 93.210534][ T5317] __mutex_lock+0x19d/0x1550 [ 93.212526][ T5317] ? blk_request_module+0x35/0x2a0 [ 93.214669][ T5317] ? lock_acquire+0x115/0x350 [ 93.216613][ T5317] ? blk_request_module+0x35/0x2a0 [ 93.218647][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 93.220727][ T5317] ? find_inode_fast+0x5dc/0x740 [ 93.222839][ T5317] ? find_inode_fast+0xd2/0x740 [ 93.224924][ T5317] blk_request_module+0x35/0x2a0 [ 93.226902][ T5317] blkdev_get_no_open+0x3f/0xe0 [ 93.228944][ T5317] bdev_file_open_by_dev+0xa0/0x240 [ 93.231028][ T5317] md_import_device+0x2e9/0x650 [ 93.233056][ T5317] md_add_new_disk+0x669/0x1850 [ 93.235123][ T5317] md_ioctl+0x200a/0x2610 [ 93.236967][ T5317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 93.239129][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 93.241085][ T5317] ? do_vfs_ioctl+0x116f/0x1530 [ 93.243195][ T5317] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 93.245336][ T5317] ? hook_file_ioctl+0x1f2/0x600 [ 93.247587][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 93.249609][ T5317] blkdev_ioctl+0x5e3/0x740 [ 93.251527][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.253703][ T5317] ? __fget_files+0x2a/0x420 [ 93.255320][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.257776][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.259880][ T5317] __se_sys_ioctl+0xfc/0x170 [ 93.261798][ T5317] do_syscall_64+0x166/0x520 [ 93.263790][ T5317] ? trace_irq_disable+0x3b/0x140 [ 93.266525][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.268893][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 93.270966][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.273535][ T5317] RIP: 0033:0x7fcf49f9e159 [ 93.275535][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.283485][ T5317] RSP: 002b:00007fcf4aefdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.286988][ T5317] RAX: ffffffffffffffda RBX: 00007fcf4a226090 RCX: 00007fcf49f9e159 [ 93.290195][ T5317] RDX: 0000200000000440 RSI: 0000000040140921 RDI: 0000000000000006 [ 93.293572][ T5317] RBP: 00007fcf4a03506b R08: 0000000000000000 R09: 0000000000000000 [ 93.296906][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.300075][ T5317] R13: 00007fcf4a226128 R14: 00007fcf4a226090 R15: 00007fff0a7c0958 [ 93.303256][ T5317] [ 93.308826][ T5320] md: resync of RAID array md0 [ 93.324451][ T5320] md: md0: resync done. [ 93.349031][ T5317] block device autoloading is deprecated and will be removed. [ 93.349678][ T5321] md: recover of RAID array md0 [ 93.362989][ T5321] md: md0: recover done.