program: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./sys\x00', &(0x7f00000003c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/module/md_mod/parameters/new_array\x00', 0x101081, 0x0) write(r0, &(0x7f0000000500)='md0', 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000680)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000180)="0192a3c7bf000000010000000100000006") r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000042000b06"], 0x14}}, 0x0) recvmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000980)=""/267, 0x10b}, {&(0x7f0000000ac0)=""/4093, 0xffd}, {&(0x7f0000001ac0)=""/258, 0x102}, {&(0x7f0000001c00)=""/187, 0xbb}], 0x4}, 0xf7d}], 0x1, 0x0, 0x0) ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000840)="0200000001") bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x2c, 0x29, 0x70bd2d, 0x25dfdbfe, {0x11}}, 0x14}, 0x1, 0x0, 0x0, 0x8c811}, 0x40040) getsockopt$inet6_int(r3, 0x29, 0x3e, 0x0, &(0x7f0000000000)) r5 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000700)={'/sys/block/md', @num=0x0, '/md/', @array='level\x00'}, 0x1, 0x0) write$md_sysfs(r5, &(0x7f0000000740)=@str='raid1', 0x5) r6 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000940)={'/sys/block/md', @num=0x0, '/md/', @rdev={@ram={'dev-ram', 0x0}, 'slot\x00'}}, 0x1, 0x0) write$md_sysfs(r6, 0x0, 0x0) [ 116.275408][ T4667] Bluetooth: hci0: command tx timeout [ 116.485098][ T5352] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 116.490332][ T5353] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 116.490539][ T5353] block device autoloading is deprecated and will be removed. [ 116.554700][ T5352] [ 116.562440][ T5352] ====================================================== [ 116.565198][ T5352] WARNING: possible circular locking dependency detected [ 116.567972][ T5352] syzkaller #0 Not tainted [ 116.569708][ T5352] ------------------------------------------------------ [ 116.572536][ T5352] syz.0.0/5352 is trying to acquire lock: [ 116.574820][ T5352] ffffffff9096eba0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 116.578567][ T5352] [ 116.578567][ T5352] but task is already holding lock: [ 116.581556][ T5352] ffff88803132e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 116.585717][ T5352] [ 116.585717][ T5352] which lock already depends on the new lock. [ 116.585717][ T5352] [ 116.589577][ T5352] [ 116.589577][ T5352] the existing dependency chain (in reverse order) is: [ 116.592905][ T5352] [ 116.592905][ T5352] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 116.598300][ T5352] __mutex_lock+0x197/0x15a0 [ 116.600303][ T5352] md_alloc+0x81e/0xf40 [ 116.602186][ T5352] md_alloc_and_put+0x1a/0x1f0 [ 116.604362][ T5352] add_named_array+0x240/0x350 [ 116.606484][ T5352] param_attr_store+0x214/0x310 [ 116.608711][ T5352] module_attr_store+0x65/0x90 [ 116.610789][ T5352] kernfs_fop_write_iter+0x3a4/0x540 [ 116.613424][ T5352] vfs_write+0x612/0xba0 [ 116.615502][ T5352] ksys_write+0x150/0x270 [ 116.617428][ T5352] do_syscall_64+0x16a/0x530 [ 116.619527][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.622148][ T5352] [ 116.622148][ T5352] -> #1 (disks_mutex){+.+.}-{4:4}: [ 116.625043][ T5352] __mutex_lock+0x197/0x15a0 [ 116.627111][ T5352] md_alloc+0x40/0xf40 [ 116.629034][ T5352] md_alloc_and_put+0x1a/0x1f0 [ 116.631132][ T5352] blk_request_module+0x27d/0x2a0 [ 116.633503][ T5352] blkdev_get_no_open+0x3f/0xe0 [ 116.635746][ T5352] blkdev_open+0x1d7/0x600 [ 116.637828][ T5352] do_dentry_open+0x80e/0x1360 [ 116.639946][ T5352] vfs_open_consume+0x4a/0x350 [ 116.642085][ T5352] path_openat+0x16fc/0x20f0 [ 116.644179][ T5352] do_file_open+0x23e/0x4a0 [ 116.646192][ T5352] do_sys_openat2+0x115/0x200 [ 116.648389][ T5352] __x64_sys_openat+0x138/0x170 [ 116.650487][ T5352] do_syscall_64+0x16a/0x530 [ 116.652582][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.655464][ T5352] [ 116.655464][ T5352] -> #0 (major_names_lock){+.+.}-{4:4}: [ 116.658681][ T5352] __lock_acquire+0x164c/0x2de0 [ 116.660766][ T5352] lock_acquire+0x115/0x350 [ 116.662781][ T5352] __mutex_lock+0x197/0x15a0 [ 116.664888][ T5352] blk_request_module+0x35/0x2a0 [ 116.667121][ T5352] blkdev_get_no_open+0x3f/0xe0 [ 116.669233][ T5352] bdev_file_open_by_dev+0xa0/0x240 [ 116.671506][ T5352] md_import_device+0x2e9/0x650 [ 116.673738][ T5352] md_add_new_disk+0x522/0x1850 [ 116.675885][ T5352] md_ioctl+0x2027/0x2630 [ 116.677800][ T5352] blkdev_ioctl+0x5e3/0x740 [ 116.679847][ T5352] __se_sys_ioctl+0xfc/0x170 [ 116.681851][ T5352] do_syscall_64+0x16a/0x530 [ 116.684060][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.686571][ T5352] [ 116.686571][ T5352] other info that might help us debug this: [ 116.686571][ T5352] [ 116.690547][ T5352] Chain exists of: [ 116.690547][ T5352] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 116.690547][ T5352] [ 116.695669][ T5352] Possible unsafe locking scenario: [ 116.695669][ T5352] [ 116.698584][ T5352] CPU0 CPU1 [ 116.700688][ T5352] ---- ---- [ 116.704520][ T5352] lock(&mddev->reconfig_mutex); [ 116.706726][ T5352] lock(disks_mutex); [ 116.709506][ T5352] lock(&mddev->reconfig_mutex); [ 116.712674][ T5352] lock(major_names_lock); [ 116.714802][ T5352] [ 116.714802][ T5352] *** DEADLOCK *** [ 116.714802][ T5352] [ 116.718214][ T5352] locks held by syz.0.0/5352: 1, on CPU#0: [ 116.720690][ T5352] #0: ffff88803132e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 116.725146][ T5352] [ 116.725146][ T5352] stack backtrace: [ 116.727662][ T5352] CPU: 0 UID: 0 PID: 5352 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 116.731146][ T5352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.736092][ T5352] Call Trace: [ 116.737466][ T5352] [ 116.738727][ T5352] dump_stack_lvl+0xe8/0x150 [ 116.740608][ T5352] print_circular_bug+0x2e2/0x300 [ 116.742736][ T5352] check_noncircular+0x12f/0x150 [ 116.744867][ T5352] __lock_acquire+0x164c/0x2de0 [ 116.746944][ T5352] ? post_alloc_hook+0x208/0x250 [ 116.749109][ T5352] ? get_page_from_freelist+0x2224/0x2290 [ 116.751467][ T5352] lock_acquire+0x115/0x350 [ 116.753308][ T5352] ? blk_request_module+0x35/0x2a0 [ 116.755417][ T5352] __mutex_lock+0x197/0x15a0 [ 116.757215][ T5352] ? blk_request_module+0x35/0x2a0 [ 116.759177][ T5352] ? lock_acquire+0x115/0x350 [ 116.761123][ T5352] ? blk_request_module+0x35/0x2a0 [ 116.763176][ T5352] ? __pfx___mutex_lock+0x10/0x10 [ 116.765182][ T5352] ? find_inode_fast+0x5dc/0x740 [ 116.767258][ T5352] ? find_inode_fast+0xd2/0x740 [ 116.769301][ T5352] blk_request_module+0x35/0x2a0 [ 116.771405][ T5352] blkdev_get_no_open+0x3f/0xe0 [ 116.773482][ T5352] bdev_file_open_by_dev+0xa0/0x240 [ 116.775510][ T5352] md_import_device+0x2e9/0x650 [ 116.777587][ T5352] md_add_new_disk+0x522/0x1850 [ 116.779720][ T5352] md_ioctl+0x2027/0x2630 [ 116.781383][ T5352] ? tomoyo_path_number_perm+0x219/0x5f0 [ 116.785856][ T5352] ? __pfx_md_ioctl+0x10/0x10 [ 116.787800][ T5352] ? do_vfs_ioctl+0x116f/0x1530 [ 116.789668][ T5352] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 116.791803][ T5352] ? do_futex+0x3e7/0x4e0 [ 116.793539][ T5352] ? __pfx_md_ioctl+0x10/0x10 [ 116.795478][ T5352] blkdev_ioctl+0x5e3/0x740 [ 116.797366][ T5352] ? __pfx_blkdev_ioctl+0x10/0x10 [ 116.799476][ T5352] ? bpf_lsm_file_ioctl+0x9/0x20 [ 116.801627][ T5352] ? __pfx_blkdev_ioctl+0x10/0x10 [ 116.803798][ T5352] __se_sys_ioctl+0xfc/0x170 [ 116.805778][ T5352] do_syscall_64+0x16a/0x530 [ 116.807730][ T5352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.809981][ T5352] ? clear_bhb_loop+0x70/0xc0 [ 116.811809][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.814317][ T5352] RIP: 0033:0x7f26bcf9fb19 [ 116.817647][ T5352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.825130][ T5352] RSP: 002b:00007f26bde8efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.828493][ T5352] RAX: ffffffffffffffda RBX: 00007f26bd225fa0 RCX: 00007f26bcf9fb19 [ 116.831547][ T5352] RDX: 0000200000000180 RSI: 0000000040140921 RDI: 0000000000000004 [ 116.834587][ T5352] RBP: 00007f26bd037b70 R08: 0000000000000000 R09: 0000000000000000 [ 116.837781][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.840792][ T5352] R13: 00007f26bd226038 R14: 00007f26bd225fa0 R15: 00007ffdd5bd4578 [ 116.843818][ T5352] [ 116.924218][ T5352] md: could not open device unknown-block(191,1). [ 116.924252][ T5352] md: error, md_import_device() returned -6 [ 116.928089][ T5352] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate.