program: r0 = socket$inet(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ef) mount(&(0x7f0000000140)=@filename='mtd0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./dev\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f00000004c0)="000000005a000000030000000000000000000000000000000100000001") ioctl(r2, 0x40140921, &(0x7f0000000500)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) r4 = syz_open_procfs(r3, &(0x7f0000000240)='schedstat\x00') pread64(r4, &(0x7f0000000980)=""/102356, 0x18fd4, 0x200) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000019980)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'syz_tun\x00'}) sendmsg$nl_route(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="5000000010001000"/20, @ANYRES32=0x0, @ANYBLOB="8020000000000b0000000062000000000000000000e57340da0b00010062726964676500000c0002800800050000"], 0x50}}, 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000640)={'veth1_to_bond\x00'}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/class/net/bond0/bonding/slaves\x00', 0x1, 0x0) write(r7, &(0x7f00000006c0)='+dummy0', 0x7) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000199c0)=[{&(0x7f0000019a00)="1400000016000b63d25a80648c2594f90224fc60", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000840)={'bridge0\x00'}) [ 95.644155][ T4660] Bluetooth: hci0: command tx timeout [ 95.736440][ T5339] jffs2: notice: (5339) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 95.899431][ T5340] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.900078][ T5340] block device autoloading is deprecated and will be removed. qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xae000) [ 95.910183][ T5339] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 95.933842][ T1028] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 95.933859][ T1028] ata1: failed to read log page 10h (errno=-5) [ 95.933888][ T1028] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 95.933909][ T1028] ata1.00: irq_stat 0x41000000 [ 95.933925][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED [ 95.933932][ T1028] ata1.00: cmd 61/70:70:a6:1a:08/05:00:00:00:00/40 tag 14 ncq dma 712704 out [ 95.933932][ T1028] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 95.933961][ T1028] ata1.00: status: { DRDY } [ 95.933970][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED [ 95.933976][ T1028] ata1.00: cmd 61/50:78:16:05:10/00:00:00:00:00/40 tag 15 ncq dma 40960 out [ 95.933976][ T1028] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 95.934005][ T1028] ata1.00: status: { DRDY } [ 95.935426][ T1028] ata1.00: configured for UDMA/100 [ 95.979761][ T1028] ata1: EH complete [ 95.995919][ T5339] [ 95.997007][ T5339] ====================================================== [ 95.999878][ T5339] WARNING: possible circular locking dependency detected [ 96.002875][ T5339] syzkaller #0 Not tainted [ 96.004754][ T5339] ------------------------------------------------------ [ 96.007554][ T5339] syz.0.0/5339 is trying to acquire lock: [ 96.009864][ T5339] ffffffff9096e2e0 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 96.013964][ T5339] [ 96.013964][ T5339] but task is already holding lock: [ 96.016984][ T5339] ffff888013832358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 96.021266][ T5339] [ 96.021266][ T5339] which lock already depends on the new lock. [ 96.021266][ T5339] [ 96.025499][ T5339] [ 96.025499][ T5339] the existing dependency chain (in reverse order) is: [ 96.029177][ T5339] [ 96.029177][ T5339] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 96.032216][ T5339] __mutex_lock+0x197/0x15a0 [ 96.034346][ T5339] md_alloc+0x81e/0xf40 [ 96.036322][ T5339] md_alloc_and_put+0x1a/0x1f0 [ 96.038551][ T5339] add_named_array+0x240/0x350 [ 96.040736][ T5339] param_attr_store+0x214/0x310 [ 96.043065][ T5339] module_attr_store+0x65/0x90 [ 96.045429][ T5339] kernfs_fop_write_iter+0x3a4/0x540 [ 96.048101][ T5339] vfs_write+0x612/0xba0 [ 96.050290][ T5339] ksys_write+0x150/0x270 [ 96.052431][ T5339] do_syscall_64+0x16a/0x530 [ 96.054605][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.057288][ T5339] [ 96.057288][ T5339] -> #1 (disks_mutex){+.+.}-{4:4}: [ 96.060266][ T5339] __mutex_lock+0x197/0x15a0 [ 96.062288][ T5339] md_alloc+0x40/0xf40 [ 96.064316][ T5339] md_alloc_and_put+0x1a/0x1f0 [ 96.066513][ T5339] blk_request_module+0x27d/0x2a0 [ 96.068748][ T5339] blkdev_get_no_open+0x3f/0xe0 [ 96.070931][ T5339] blkdev_open+0x1d7/0x600 [ 96.072927][ T5339] do_dentry_open+0x80e/0x1360 [ 96.075156][ T5339] vfs_open_consume+0x4a/0x350 [ 96.077380][ T5339] path_openat+0x16fc/0x20f0 [ 96.079464][ T5339] do_file_open+0x23e/0x4a0 [ 96.081524][ T5339] do_sys_openat2+0x115/0x200 [ 96.083574][ T5339] __x64_sys_openat+0x138/0x170 [ 96.085830][ T5339] do_syscall_64+0x16a/0x530 [ 96.088095][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.090818][ T5339] [ 96.090818][ T5339] -> #0 (major_names_lock){+.+.}-{4:4}: [ 96.094033][ T5339] __lock_acquire+0x164c/0x2de0 [ 96.096232][ T5339] lock_acquire+0x115/0x350 [ 96.098345][ T5339] __mutex_lock+0x197/0x15a0 [ 96.100176][ T5339] blk_request_module+0x35/0x2a0 [ 96.102142][ T5339] blkdev_get_no_open+0x3f/0xe0 [ 96.104125][ T5339] bdev_file_open_by_dev+0xa0/0x240 [ 96.106169][ T5339] md_import_device+0x2e9/0x650 [ 96.108136][ T5339] md_add_new_disk+0x522/0x1850 [ 96.110036][ T5339] md_ioctl+0x2027/0x2630 [ 96.111757][ T5339] blkdev_ioctl+0x5e3/0x740 [ 96.113442][ T5339] __se_sys_ioctl+0xfc/0x170 [ 96.115459][ T5339] do_syscall_64+0x16a/0x530 [ 96.117432][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.120073][ T5339] [ 96.120073][ T5339] other info that might help us debug this: [ 96.120073][ T5339] [ 96.124203][ T5339] Chain exists of: [ 96.124203][ T5339] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 96.124203][ T5339] [ 96.129976][ T5339] Possible unsafe locking scenario: [ 96.129976][ T5339] [ 96.133087][ T5339] CPU0 CPU1 [ 96.135221][ T5339] ---- ---- [ 96.137497][ T5339] lock(&mddev->reconfig_mutex); [ 96.139640][ T5339] lock(disks_mutex); [ 96.142203][ T5339] lock(&mddev->reconfig_mutex); [ 96.145383][ T5339] lock(major_names_lock); [ 96.147352][ T5339] [ 96.147352][ T5339] *** DEADLOCK *** [ 96.147352][ T5339] [ 96.150618][ T5339] locks held by syz.0.0/5339: 1, on CPU#0: [ 96.153012][ T5339] #0: ffff888013832358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 96.157393][ T5339] [ 96.157393][ T5339] stack backtrace: [ 96.159910][ T5339] CPU: 0 UID: 0 PID: 5339 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.163484][ T5339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.167656][ T5339] Call Trace: [ 96.169039][ T5339] [ 96.170291][ T5339] dump_stack_lvl+0xe8/0x150 [ 96.172253][ T5339] print_circular_bug+0x2e2/0x300 [ 96.174353][ T5339] check_noncircular+0x12f/0x150 [ 96.176393][ T5339] __lock_acquire+0x164c/0x2de0 [ 96.178418][ T5339] ? post_alloc_hook+0x208/0x250 [ 96.180461][ T5339] ? get_page_from_freelist+0x225d/0x22e0 [ 96.182806][ T5339] lock_acquire+0x115/0x350 [ 96.184665][ T5339] ? blk_request_module+0x35/0x2a0 [ 96.186808][ T5339] __mutex_lock+0x197/0x15a0 [ 96.188816][ T5339] ? blk_request_module+0x35/0x2a0 [ 96.190897][ T5339] ? lock_acquire+0x115/0x350 [ 96.192876][ T5339] ? blk_request_module+0x35/0x2a0 [ 96.194962][ T5339] ? __pfx___mutex_lock+0x10/0x10 [ 96.197122][ T5339] ? find_inode_fast+0x5dc/0x740 [ 96.199250][ T5339] ? find_inode_fast+0xd2/0x740 [ 96.201363][ T5339] blk_request_module+0x35/0x2a0 [ 96.203452][ T5339] blkdev_get_no_open+0x3f/0xe0 [ 96.205528][ T5339] bdev_file_open_by_dev+0xa0/0x240 [ 96.207680][ T5339] md_import_device+0x2e9/0x650 [ 96.209726][ T5339] md_add_new_disk+0x522/0x1850 [ 96.211693][ T5339] md_ioctl+0x2027/0x2630 [ 96.213573][ T5339] ? tomoyo_path_number_perm+0x219/0x5f0 [ 96.216309][ T5339] ? __pfx_md_ioctl+0x10/0x10 [ 96.218305][ T5339] ? do_vfs_ioctl+0x11a7/0x1570 [ 96.220424][ T5339] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 96.222589][ T5339] ? do_futex+0x3e7/0x4e0 [ 96.224494][ T5339] ? __pfx_md_ioctl+0x10/0x10 [ 96.226529][ T5339] blkdev_ioctl+0x5e3/0x740 [ 96.228242][ T5339] ? __pfx_blkdev_ioctl+0x10/0x10 [ 96.230359][ T5339] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.232318][ T5339] ? __pfx_blkdev_ioctl+0x10/0x10 [ 96.234190][ T5339] __se_sys_ioctl+0xfc/0x170 [ 96.236223][ T5339] do_syscall_64+0x16a/0x530 [ 96.238031][ T5339] ? trace_irq_disable+0x3b/0x140 [ 96.239961][ T5339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.242581][ T5339] ? clear_bhb_loop+0x70/0xc0 [ 96.244561][ T5339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.246982][ T5339] RIP: 0033:0x7fa6d31a8f19 [ 96.248846][ T5339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.256620][ T5339] RSP: 002b:00007fa6d3f86fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.260050][ T5339] RAX: ffffffffffffffda RBX: 00007fa6d3425fa0 RCX: 00007fa6d31a8f19 [ 96.263444][ T5339] RDX: 0000200000000500 RSI: 0000000040140921 RDI: 0000000000000005 [ 96.267013][ T5339] RBP: 00007fa6d3237f6d R08: 0000000000000000 R09: 0000000000000000 [ 96.270630][ T5339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.273711][ T5339] R13: 00007fa6d3426038 R14: 00007fa6d3425fa0 R15: 00007ffc8cf87b48 [ 96.276924][ T5339] [ 96.318254][ T5347] Zero length message leads to an empty skb [ 96.449557][ T5339] md: could not open device unknown-block(0,0). [ 96.449592][ T5339] md: error, md_import_device() returned -6