program: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) mknodat$md(0xffffffffffffff9c, &(0x7f0000000040)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000080)='./md0\x00', 0x2, 0x0) ioctl$ADD_NEW_DISK(r0, 0x40140921, 0x0) [ 103.296480][ T5302] Bluetooth: hci0: command tx timeout [ 103.432113][ T5355] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 103.432224][ T5355] block device autoloading is deprecated and will be removed. [ 103.445345][ T5355] [ 103.446555][ T5355] ====================================================== [ 103.449730][ T5355] WARNING: possible circular locking dependency detected [ 103.453085][ T5355] syzkaller #0 Not tainted [ 103.455205][ T5355] ------------------------------------------------------ [ 103.458273][ T5355] syz.0.0/5355 is trying to acquire lock: [ 103.460860][ T5355] ffffffff9096e2e0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 103.467984][ T5355] [ 103.467984][ T5355] but task is already holding lock: [ 103.471254][ T5355] ffff888038f84358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.475835][ T5355] [ 103.475835][ T5355] which lock already depends on the new lock. [ 103.475835][ T5355] [ 103.480313][ T5355] [ 103.480313][ T5355] the existing dependency chain (in reverse order) is: [ 103.484243][ T5355] [ 103.484243][ T5355] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 103.487575][ T5355] __mutex_lock+0x197/0x15a0 [ 103.490399][ T5355] md_alloc+0x81e/0xf40 [ 103.492444][ T5355] md_alloc_and_put+0x1a/0x1f0 [ 103.494831][ T5355] blk_request_module+0x27d/0x2a0 [ 103.497312][ T5355] blkdev_get_no_open+0x3f/0xe0 [ 103.499720][ T5355] blkdev_open+0x1d7/0x600 [ 103.502014][ T5355] do_dentry_open+0x80e/0x1360 [ 103.504354][ T5355] vfs_open_consume+0x4a/0x350 [ 103.506472][ T5355] path_openat+0x16fc/0x20f0 [ 103.508595][ T5355] do_file_open+0x23e/0x4a0 [ 103.510686][ T5355] do_sys_openat2+0x115/0x200 [ 103.512842][ T5355] __x64_sys_openat+0x138/0x170 [ 103.515046][ T5355] do_syscall_64+0x16a/0x530 [ 103.517186][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.520025][ T5355] [ 103.520025][ T5355] -> #1 (disks_mutex){+.+.}-{4:4}: [ 103.523367][ T5355] __mutex_lock+0x197/0x15a0 [ 103.525763][ T5355] md_alloc+0x40/0xf40 [ 103.527911][ T5355] md_alloc_and_put+0x1a/0x1f0 [ 103.530372][ T5355] blk_request_module+0x27d/0x2a0 [ 103.532936][ T5355] blkdev_get_no_open+0x3f/0xe0 [ 103.535399][ T5355] blkdev_open+0x1d7/0x600 [ 103.537644][ T5355] do_dentry_open+0x80e/0x1360 [ 103.540050][ T5355] vfs_open_consume+0x4a/0x350 [ 103.542412][ T5355] path_openat+0x16fc/0x20f0 [ 103.544725][ T5355] do_file_open+0x23e/0x4a0 [ 103.547022][ T5355] do_sys_openat2+0x115/0x200 [ 103.549313][ T5355] __x64_sys_openat+0x138/0x170 [ 103.551725][ T5355] do_syscall_64+0x16a/0x530 [ 103.553894][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.556831][ T5355] [ 103.556831][ T5355] -> #0 (major_names_lock){+.+.}-{4:4}: [ 103.560232][ T5355] __lock_acquire+0x164c/0x2de0 [ 103.562603][ T5355] lock_acquire+0x115/0x350 [ 103.564807][ T5355] __mutex_lock+0x197/0x15a0 [ 103.567056][ T5355] blk_request_module+0x35/0x2a0 [ 103.569381][ T5355] blkdev_get_no_open+0x3f/0xe0 [ 103.571767][ T5355] bdev_file_open_by_dev+0xa0/0x240 [ 103.574262][ T5355] md_import_device+0x2e9/0x650 [ 103.576502][ T5355] md_add_new_disk+0x3a3/0x1850 [ 103.578734][ T5355] md_ioctl+0x2027/0x2630 [ 103.580675][ T5355] blkdev_ioctl+0x5e3/0x740 [ 103.582760][ T5355] __se_sys_ioctl+0xfc/0x170 [ 103.584858][ T5355] do_syscall_64+0x16a/0x530 [ 103.587040][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.589805][ T5355] [ 103.589805][ T5355] other info that might help us debug this: [ 103.589805][ T5355] [ 103.594219][ T5355] Chain exists of: [ 103.594219][ T5355] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 103.594219][ T5355] [ 103.599237][ T5355] Possible unsafe locking scenario: [ 103.599237][ T5355] [ 103.602424][ T5355] CPU0 CPU1 [ 103.604841][ T5355] ---- ---- [ 103.607181][ T5355] lock(&mddev->reconfig_mutex); [ 103.609322][ T5355] lock(disks_mutex); [ 103.612143][ T5355] lock(&mddev->reconfig_mutex); [ 103.615461][ T5355] lock(major_names_lock); [ 103.617538][ T5355] [ 103.617538][ T5355] *** DEADLOCK *** [ 103.617538][ T5355] [ 103.621150][ T5355] locks held by syz.0.0/5355: 1, on CPU#0: [ 103.623492][ T5355] #0: ffff888038f84358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 103.628113][ T5355] [ 103.628113][ T5355] stack backtrace: [ 103.630746][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.634724][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.639105][ T5355] Call Trace: [ 103.640684][ T5355] [ 103.642071][ T5355] dump_stack_lvl+0xe8/0x150 [ 103.644189][ T5355] print_circular_bug+0x2e2/0x300 [ 103.646475][ T5355] check_noncircular+0x12f/0x150 [ 103.648609][ T5355] __lock_acquire+0x164c/0x2de0 [ 103.650831][ T5355] ? post_alloc_hook+0x208/0x250 [ 103.653091][ T5355] ? get_page_from_freelist+0x225d/0x22e0 [ 103.655676][ T5355] lock_acquire+0x115/0x350 [ 103.657890][ T5355] ? blk_request_module+0x35/0x2a0 [ 103.660265][ T5355] __mutex_lock+0x197/0x15a0 [ 103.662370][ T5355] ? blk_request_module+0x35/0x2a0 [ 103.664685][ T5355] ? lock_acquire+0x115/0x350 [ 103.666720][ T5355] ? blk_request_module+0x35/0x2a0 [ 103.669041][ T5355] ? __pfx___mutex_lock+0x10/0x10 [ 103.671342][ T5355] ? find_inode_fast+0x5dc/0x740 [ 103.673567][ T5355] ? find_inode_fast+0xd2/0x740 [ 103.675801][ T5355] blk_request_module+0x35/0x2a0 [ 103.678010][ T5355] blkdev_get_no_open+0x3f/0xe0 [ 103.679937][ T5355] bdev_file_open_by_dev+0xa0/0x240 [ 103.683191][ T5355] md_import_device+0x2e9/0x650 [ 103.685349][ T5355] md_add_new_disk+0x3a3/0x1850 [ 103.687243][ T5355] md_ioctl+0x2027/0x2630 [ 103.689022][ T5355] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.691496][ T5355] ? __pfx_md_ioctl+0x10/0x10 [ 103.693613][ T5355] ? do_vfs_ioctl+0x11a7/0x1570 [ 103.695883][ T5355] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.698033][ T5355] ? do_futex+0x3e7/0x4e0 [ 103.699978][ T5355] ? __pfx_md_ioctl+0x10/0x10 [ 103.702112][ T5355] blkdev_ioctl+0x5e3/0x740 [ 103.704085][ T5355] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.706406][ T5355] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.708533][ T5355] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.710920][ T5355] __se_sys_ioctl+0xfc/0x170 [ 103.713032][ T5355] do_syscall_64+0x16a/0x530 [ 103.715171][ T5355] ? trace_irq_disable+0x3b/0x140 [ 103.717419][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.720144][ T5355] ? clear_bhb_loop+0x70/0xc0 [ 103.722312][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.724930][ T5355] RIP: 0033:0x7f8001da8f19 [ 103.726876][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.735058][ T5355] RSP: 002b:00007f8002b94fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.738655][ T5355] RAX: ffffffffffffffda RBX: 00007f8002025fa0 RCX: 00007f8001da8f19 [ 103.742121][ T5355] RDX: 0000000000000000 RSI: 0000000040140921 RDI: 0000000000000005 [ 103.745596][ T5355] RBP: 00007f8001e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 103.749040][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.752639][ T5355] R13: 00007f8002026038 R14: 00007f8002025fa0 R15: 00007ffd6e97d248 [ 103.756136][ T5355] [ 103.814681][ T5355] md: could not open device unknown-block(4,0). [ 103.814802][ T5355] md: md_import_device returned -6