====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/0:14/5494 is trying to acquire lock: ffff0000f1d86748 (kn->active#68){++++}-{0:0}, at: __kernfs_remove+0x3c0/0x654 fs/kernfs/dir.c:1461 but task is already holding lock: ffff800022597c40 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}: process_one_work+0x710/0x13bc kernel/workqueue.c:2268 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 -> #3 ((wq_completion)md_misc){+.+.}-{0:0}: __flush_workqueue+0x134/0x1060 kernel/workqueue.c:2812 md_alloc+0x44/0xb3c drivers/md/md.c:5708 md_alloc_and_put drivers/md/md.c:5800 [inline] md_probe+0x68/0xdc drivers/md/md.c:5813 blk_probe_dev block/genhd.c:756 [inline] blk_request_module+0x274/0x29c block/genhd.c:-1 blkdev_get_no_open+0x48/0xdc block/bdev.c:758 blkdev_get_by_dev+0x84/0x8b8 block/bdev.c:815 blkdev_open+0x108/0x2a0 block/fops.c:500 do_dentry_open+0x738/0xf8c fs/open.c:882 vfs_open+0x7c/0x90 fs/open.c:1015 do_open fs/namei.c:3677 [inline] path_openat+0x1fc0/0x27a0 fs/namei.c:3834 do_filp_open+0x198/0x38c fs/namei.c:3861 do_sys_openat2+0x134/0x3fc fs/open.c:1320 do_sys_open fs/open.c:1336 [inline] __do_sys_openat fs/open.c:1352 [inline] __se_sys_openat fs/open.c:1347 [inline] __arm64_sys_openat+0x11c/0x150 fs/open.c:1347 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 -> #2 (major_names_lock){+.+.}-{3:3}: __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 blk_probe_dev block/genhd.c:753 [inline] blk_request_module+0x40/0x29c block/genhd.c:769 blkdev_get_no_open+0x48/0xdc block/bdev.c:758 blkdev_get_by_dev+0x84/0x8b8 block/bdev.c:815 lock_rdev drivers/md/md.c:2561 [inline] md_import_device+0x2a4/0x598 drivers/md/md.c:3751 new_dev_store+0x2f4/0x554 drivers/md/md.c:-1 md_attr_store+0x168/0x234 drivers/md/md.c:5633 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2271 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 -> #1 (&mddev->reconfig_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_interruptible_nested+0x38/0x44 kernel/locking/mutex.c:821 mddev_lock drivers/md/md.h:577 [inline] array_state_store+0x28c/0x944 drivers/md/md.c:4479 md_attr_store+0x168/0x234 drivers/md/md.c:5633 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2271 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 -> #0 (kn->active#68){++++}-{0:0}: check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790 kernfs_drain+0x294/0x5f8 fs/kernfs/dir.c:499 __kernfs_remove+0x3c0/0x654 fs/kernfs/dir.c:1461 kernfs_remove_by_name_ns+0xe4/0x184 fs/kernfs/dir.c:1667 kernfs_remove_by_name include/linux/kernfs.h:622 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0xf4/0x278 fs/sysfs/group.c:288 sysfs_remove_groups+0x5c/0xb4 fs/sysfs/group.c:312 __kobject_del+0x94/0x2d4 lib/kobject.c:587 kobject_cleanup lib/kobject.c:672 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2c0/0x41c lib/kobject.c:729 mddev_delayed_delete+0x20/0x30 drivers/md/md.c:5667 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 other info that might help us debug this: Chain exists of: kn->active#68 --> (wq_completion)md_misc --> (work_completion)(&mddev->del_work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((work_completion)(&mddev->del_work)); lock((wq_completion)md_misc); lock((work_completion)(&mddev->del_work)); lock(kn->active#68); *** DEADLOCK *** 2 locks held by kworker/0:14/5494: #0: ffff0000c415b138 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1 #1: ffff800022597c40 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267 stack backtrace: CPU: 0 PID: 5494 Comm: kworker/0:14 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: md_misc mddev_delayed_delete dump_backtrace(regs = 0000000000000000 tsk = 0000000000000000) Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2088 check_noncircular+0x290/0x370 kernel/locking/lockdep.c:2215 check_prev_add kernel/locking/lockdep.c:3162 [inline] check_prevs_add kernel/locking/lockdep.c:3281 [inline] validate_chain kernel/locking/lockdep.c:3897 [inline] __lock_acquire+0x3504/0x7280 kernel/locking/lockdep.c:5171 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790 kernfs_drain+0x294/0x5f8 fs/kernfs/dir.c:499 __kernfs_remove+0x3c0/0x654 fs/kernfs/dir.c:1461 kernfs_remove_by_name_ns+0xe4/0x184 fs/kernfs/dir.c:1667 kernfs_remove_by_name include/linux/kernfs.h:622 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0xf4/0x278 fs/sysfs/group.c:288 sysfs_remove_groups+0x5c/0xb4 fs/sysfs/group.c:312 __kobject_del+0x94/0x2d4 lib/kobject.c:587 kobject_cleanup lib/kobject.c:672 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2c0/0x41c lib/kobject.c:729 mddev_delayed_delete+0x20/0x30 drivers/md/md.c:5667 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 kernfs reshape_position: removing kernfs reshape_direction: removing kernfs array_size: removing kernfs max_read_errors: removing kernfs consistency_policy: removing kernfs fail_last_dev: removing kernfs serialize_policy: removing kernfs location: removing kernfs space: removing kernfs time_base: removing kernfs backlog: removing kernfs chunksize: removing kernfs metadata: removing kernfs can_clear: removing kernfs max_backlog_used: removing kernfs bitmap: removing kernfs md: removing kobject: 'md' (0000000072319d0d): calling ktype release kernfs bdi: removing device: '9:8': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs subsystem: removing kernfs 9:8: removing kernfs uevent: removing kernfs read_ahead_kb: removing kernfs min_ratio: removing kernfs max_ratio: removing kernfs stable_pages_required: removing PM: Removing info for No Bus:9:8 kobject: '9:8' (00000000e420a333): kobject_uevent_env kobject: '9:8' (00000000e420a333): fill_kobj_path: path = '/devices/virtual/bdi/9:8' kernfs 9:8: removing kobject: '9:8' (00000000e420a333): kobject_cleanup, parent 0000000000000000 kobject: '9:8' (00000000e420a333): calling ktype release device: '9:8': device_create_release kobject: '9:8': free name kobject: 'queue' (0000000082543d76): kobject_uevent_env kobject: 'queue' (0000000082543d76): kobject_uevent_env: filter function caused the event to drop! kernfs nr_requests: removing kernfs read_ahead_kb: removing kernfs max_hw_sectors_kb: removing kernfs max_sectors_kb: removing kernfs max_segments: removing kernfs max_discard_segments: removing kernfs max_integrity_segments: removing kernfs max_segment_size: removing kernfs scheduler: removing kernfs hw_sector_size: removing kernfs logical_block_size: removing kernfs physical_block_size: removing kernfs chunk_sectors: removing kernfs minimum_io_size: removing kernfs optimal_io_size: removing kernfs discard_granularity: removing kernfs discard_max_bytes: removing kernfs discard_max_hw_bytes: removing kernfs discard_zeroes_data: removing kernfs write_same_max_bytes: removing kernfs write_zeroes_max_bytes: removing kernfs zone_append_max_bytes: removing kernfs zone_write_granularity: removing kernfs rotational: removing kernfs zoned: removing kernfs nr_zones: removing kernfs nomerges: removing kernfs rq_affinity: removing kernfs iostats: removing kernfs stable_writes: removing kernfs add_random: removing kernfs io_poll: removing kernfs write_cache: removing kernfs fua: removing kernfs dax: removing kernfs wbt_lat_usec: removing kernfs io_poll_delay: removing kernfs virt_boundary_mask: removing kernfs dma_alignment: removing kernfs queue: removing kobject: 'holders' (00000000e9913b24): kobject_cleanup, parent 00000000232071a9 kobject: 'holders' (00000000e9913b24): auto cleanup kobject_del kernfs holders: removing kobject: 'holders' (00000000e9913b24): calling ktype release kobject: (00000000e9913b24): dynamic_kobj_release kobject: 'holders': free name kobject: 'slaves' (000000002d59c255): kobject_cleanup, parent 00000000232071a9 kobject: 'slaves' (000000002d59c255): auto cleanup kobject_del kernfs slaves: removing kobject: 'slaves' (000000002d59c255): calling ktype release kobject: (000000002d59c255): dynamic_kobj_release kobject: 'slaves': free name kernfs md8: removing kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs 9:8: removing kernfs dev: removing kernfs subsystem: removing kernfs md8: removing kernfs uevent: removing kernfs removable: removing kernfs range: removing kernfs ext_range: removing kernfs hidden: removing kernfs ro: removing kernfs size: removing kernfs alignment_offset: removing kernfs discard_alignment: removing kernfs capability: removing kernfs stat: removing kernfs inflight: removing kernfs events: removing kernfs events_async: removing kernfs events_poll_msecs: removing kernfs diskseq: removing kernfs make-it-fail: removing kernfs io-timeout-fail: removing kernfs format: removing kernfs tag_size: removing kernfs protection_interval_bytes: removing kernfs read_verify: removing kernfs write_generate: removing kernfs device_is_integrity_capable: removing kernfs integrity: removing PM: Removing info for No Bus:md8 kobject: 'md8' (00000000232071a9): kobject_uevent_env kobject: 'md8' (00000000232071a9): fill_kobj_path: path = '/devices/virtual/block/md8' kernfs md8: removing kobject: 'md': free name kobject: 'md8' (00000000232071a9): kobject_cleanup, parent 0000000000000000 kobject: 'md8' (00000000232071a9): calling ktype release kobject: 'md8': free name nf_conntrack: normal packet for 00000000eecc41fe