program: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) write$md_new_array(r0, &(0x7f0000000400)={'md', @num=0x0}, 0x3) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000880)='./dev\x00', &(0x7f00000008c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f00000009c0)="000000000000000000000000000000000a000000000400000200000002000000000000000100"/54) ioctl(r1, 0x40140921, &(0x7f0000000a40)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, 0x0) [ 172.754252][ T4666] Bluetooth: hci0: command tx timeout [ 172.905956][ T5358] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 172.910887][ T5359] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 172.911006][ T5359] block device autoloading is deprecated and will be removed. [ 172.994660][ T5358] md/raid10:md0: chunk size must be at least PAGE_SIZE(4096) and be a power of 2. [ 172.994679][ T5358] md: pers->run() failed ... [ 173.012469][ T5358] [ 173.013618][ T5358] ====================================================== [ 173.016724][ T5358] WARNING: possible circular locking dependency detected [ 173.019751][ T5358] syzkaller #0 Not tainted [ 173.021735][ T5358] ------------------------------------------------------ [ 173.024733][ T5358] syz.0.0/5358 is trying to acquire lock: [ 173.027265][ T5358] ffffffff9096e2e0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 173.031555][ T5358] [ 173.031555][ T5358] but task is already holding lock: [ 173.034841][ T5358] ffff88801f9b6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 173.039362][ T5358] [ 173.039362][ T5358] which lock already depends on the new lock. [ 173.039362][ T5358] [ 173.043722][ T5358] [ 173.043722][ T5358] the existing dependency chain (in reverse order) is: [ 173.047581][ T5358] [ 173.047581][ T5358] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 173.050715][ T5358] __mutex_lock+0x197/0x15a0 [ 173.052806][ T5358] md_alloc+0x81e/0xf40 [ 173.054892][ T5358] md_alloc_and_put+0x1a/0x1f0 [ 173.057339][ T5358] add_named_array+0x240/0x350 [ 173.059939][ T5358] param_attr_store+0x214/0x310 [ 173.062489][ T5358] module_attr_store+0x65/0x90 [ 173.064656][ T5358] kernfs_fop_write_iter+0x3a4/0x540 [ 173.067255][ T5358] vfs_write+0x612/0xba0 [ 173.069425][ T5358] ksys_write+0x150/0x270 [ 173.071565][ T5358] do_syscall_64+0x16a/0x530 [ 173.073813][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.076732][ T5358] [ 173.076732][ T5358] -> #1 (disks_mutex){+.+.}-{4:4}: [ 173.079879][ T5358] __mutex_lock+0x197/0x15a0 [ 173.081693][ T5358] md_alloc+0x40/0xf40 [ 173.083410][ T5358] md_alloc_and_put+0x1a/0x1f0 [ 173.085347][ T5358] blk_request_module+0x27d/0x2a0 [ 173.087616][ T5358] blkdev_get_no_open+0x3f/0xe0 [ 173.089914][ T5358] blkdev_open+0x1d7/0x600 [ 173.092078][ T5358] do_dentry_open+0x80e/0x1360 [ 173.094323][ T5358] vfs_open_consume+0x4a/0x350 [ 173.096557][ T5358] path_openat+0x16fc/0x20f0 [ 173.098766][ T5358] do_file_open+0x23e/0x4a0 [ 173.101269][ T5358] do_sys_openat2+0x115/0x200 [ 173.103615][ T5358] __x64_sys_openat+0x138/0x170 [ 173.105929][ T5358] do_syscall_64+0x16a/0x530 [ 173.108154][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.110922][ T5358] [ 173.110922][ T5358] -> #0 (major_names_lock){+.+.}-{4:4}: [ 173.114119][ T5358] __lock_acquire+0x164c/0x2de0 [ 173.116183][ T5358] lock_acquire+0x115/0x350 [ 173.118155][ T5358] __mutex_lock+0x197/0x15a0 [ 173.120351][ T5358] blk_request_module+0x35/0x2a0 [ 173.122616][ T5358] blkdev_get_no_open+0x3f/0xe0 [ 173.124841][ T5358] bdev_file_open_by_dev+0xa0/0x240 [ 173.127305][ T5358] md_import_device+0x2e9/0x650 [ 173.129984][ T5358] md_add_new_disk+0x522/0x1850 [ 173.132292][ T5358] md_ioctl+0x2027/0x2630 [ 173.134319][ T5358] blkdev_ioctl+0x5e3/0x740 [ 173.136415][ T5358] __se_sys_ioctl+0xfc/0x170 [ 173.138620][ T5358] do_syscall_64+0x16a/0x530 [ 173.140805][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.143490][ T5358] [ 173.143490][ T5358] other info that might help us debug this: [ 173.143490][ T5358] [ 173.147902][ T5358] Chain exists of: [ 173.147902][ T5358] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 173.147902][ T5358] [ 173.153425][ T5358] Possible unsafe locking scenario: [ 173.153425][ T5358] [ 173.156534][ T5358] CPU0 CPU1 [ 173.158795][ T5358] ---- ---- [ 173.161013][ T5358] lock(&mddev->reconfig_mutex); [ 173.163070][ T5358] lock(disks_mutex); [ 173.165682][ T5358] lock(&mddev->reconfig_mutex); [ 173.168642][ T5358] lock(major_names_lock); [ 173.170522][ T5358] [ 173.170522][ T5358] *** DEADLOCK *** [ 173.170522][ T5358] [ 173.173670][ T5358] locks held by syz.0.0/5358: 1, on CPU#0: [ 173.176153][ T5358] #0: ffff88801f9b6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 173.180498][ T5358] [ 173.180498][ T5358] stack backtrace: [ 173.183132][ T5358] CPU: 0 UID: 0 PID: 5358 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 173.186682][ T5358] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 173.190671][ T5358] Call Trace: [ 173.192077][ T5358] [ 173.193323][ T5358] dump_stack_lvl+0xe8/0x150 [ 173.195389][ T5358] print_circular_bug+0x2e2/0x300 [ 173.197745][ T5358] check_noncircular+0x12f/0x150 [ 173.199862][ T5358] __lock_acquire+0x164c/0x2de0 [ 173.202078][ T5358] ? post_alloc_hook+0x208/0x250 [ 173.204255][ T5358] ? get_page_from_freelist+0x225d/0x22e0 [ 173.206682][ T5358] lock_acquire+0x115/0x350 [ 173.208595][ T5358] ? blk_request_module+0x35/0x2a0 [ 173.210863][ T5358] __mutex_lock+0x197/0x15a0 [ 173.212912][ T5358] ? blk_request_module+0x35/0x2a0 [ 173.215091][ T5358] ? lock_acquire+0x115/0x350 [ 173.217012][ T5358] ? blk_request_module+0x35/0x2a0 [ 173.219003][ T5358] ? __pfx___mutex_lock+0x10/0x10 [ 173.221036][ T5358] ? find_inode_fast+0x5dc/0x740 [ 173.223121][ T5358] ? find_inode_fast+0xd2/0x740 [ 173.225248][ T5358] blk_request_module+0x35/0x2a0 [ 173.227318][ T5358] blkdev_get_no_open+0x3f/0xe0 [ 173.229286][ T5358] bdev_file_open_by_dev+0xa0/0x240 [ 173.231361][ T5358] md_import_device+0x2e9/0x650 [ 173.233372][ T5358] md_add_new_disk+0x522/0x1850 [ 173.235291][ T5358] md_ioctl+0x2027/0x2630 [ 173.237133][ T5358] ? tomoyo_path_number_perm+0x219/0x5f0 [ 173.239423][ T5358] ? __pfx_md_ioctl+0x10/0x10 [ 173.241304][ T5358] ? do_vfs_ioctl+0x11a7/0x1570 [ 173.243302][ T5358] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 173.245425][ T5358] ? do_futex+0x3e7/0x4e0 [ 173.247215][ T5358] ? __pfx_md_ioctl+0x10/0x10 [ 173.249379][ T5358] blkdev_ioctl+0x5e3/0x740 [ 173.251997][ T5358] ? __pfx_blkdev_ioctl+0x10/0x10 [ 173.254400][ T5358] ? bpf_lsm_file_ioctl+0x9/0x20 [ 173.256651][ T5358] ? __pfx_blkdev_ioctl+0x10/0x10 [ 173.258814][ T5358] __se_sys_ioctl+0xfc/0x170 [ 173.260760][ T5358] do_syscall_64+0x16a/0x530 [ 173.262741][ T5358] ? trace_irq_disable+0x3b/0x140 [ 173.264902][ T5358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.267538][ T5358] ? clear_bhb_loop+0x70/0xc0 [ 173.269447][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.271985][ T5358] RIP: 0033:0x7fbabf3a8f19 [ 173.273950][ T5358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.282358][ T5358] RSP: 002b:00007fbac02acfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 173.286021][ T5358] RAX: ffffffffffffffda RBX: 00007fbabf625fa0 RCX: 00007fbabf3a8f19 [ 173.289532][ T5358] RDX: 0000000000000000 RSI: 0000000040140921 RDI: 0000000000000005 [ 173.292784][ T5358] RBP: 00007fbabf437f6d R08: 0000000000000000 R09: 0000000000000000 [ 173.295998][ T5358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.299231][ T5358] R13: 00007fbabf626038 R14: 00007fbabf625fa0 R15: 00007ffdbae65e98 [ 173.302363][ T5358] [ 173.349314][ T5358] md: could not open device unknown-block(0,0). [ 173.349343][ T5358] md: error, md_import_device() returned -6