program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x1}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) [ 94.766209][ T4644] Bluetooth: hci0: command tx timeout [ 94.904139][ T5314] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 94.953322][ T5314] [ 94.954622][ T5314] ====================================================== [ 94.958180][ T5314] WARNING: possible circular locking dependency detected [ 94.961078][ T5314] syzkaller #0 Not tainted [ 94.963082][ T5314] ------------------------------------------------------ [ 94.966085][ T5314] syz.0.0/5314 is trying to acquire lock: [ 94.968591][ T5314] ffffffff8fc71de0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 94.972716][ T5314] [ 94.972716][ T5314] but task is already holding lock: [ 94.975964][ T5314] ffff88803ed66390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 94.979494][ T5314] [ 94.979494][ T5314] which lock already depends on the new lock. [ 94.979494][ T5314] [ 94.983700][ T5314] [ 94.983700][ T5314] the existing dependency chain (in reverse order) is: [ 94.987514][ T5314] [ 94.987514][ T5314] -> #2 (&gi->lock){+.+.}-{4:4}: [ 94.990576][ T5314] __mutex_lock+0x19d/0x1550 [ 94.992919][ T5314] config_usb_cfg_link+0x59/0x260 [ 94.995365][ T5314] configfs_symlink+0x74e/0x11d0 [ 94.997861][ T5314] vfs_symlink+0x18b/0x330 [ 94.999992][ T5314] filename_symlinkat+0x1cd/0x410 [ 95.002256][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 95.004564][ T5314] do_syscall_64+0x166/0x520 [ 95.006862][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.009479][ T5314] [ 95.009479][ T5314] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 95.013196][ T5314] down_write+0x96/0x200 [ 95.015340][ T5314] configfs_depend_item_unlocked+0x153/0x420 [ 95.018262][ T5314] usbg_make_tpg+0x1e0/0x550 [ 95.020242][ T5314] target_fabric_make_tpg+0xa8/0x6d0 [ 95.022646][ T5314] configfs_mkdir+0x4f6/0x9e0 [ 95.024933][ T5314] vfs_mkdir+0x40c/0x620 [ 95.026862][ T5314] filename_mkdirat+0x285/0x510 [ 95.028916][ T5314] __se_sys_mkdirat+0x35/0x150 [ 95.030967][ T5314] do_syscall_64+0x166/0x520 [ 95.033028][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.035517][ T5314] [ 95.035517][ T5314] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 95.038646][ T5314] __lock_acquire+0x164c/0x2de0 [ 95.040817][ T5314] lock_acquire+0x115/0x350 [ 95.043053][ T5314] __mutex_lock+0x19d/0x1550 [ 95.045279][ T5314] tcm_alloc+0x21/0x2e0 [ 95.047387][ T5314] usb_get_function+0x63/0xb0 [ 95.049627][ T5314] config_usb_cfg_link+0x148/0x260 [ 95.052087][ T5314] configfs_symlink+0x74e/0x11d0 [ 95.054425][ T5314] vfs_symlink+0x18b/0x330 [ 95.056898][ T5314] filename_symlinkat+0x1cd/0x410 [ 95.059352][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 95.061676][ T5314] do_syscall_64+0x166/0x520 [ 95.063879][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.066654][ T5314] [ 95.066654][ T5314] other info that might help us debug this: [ 95.066654][ T5314] [ 95.070976][ T5314] Chain exists of: [ 95.070976][ T5314] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 95.070976][ T5314] [ 95.076537][ T5314] Possible unsafe locking scenario: [ 95.076537][ T5314] [ 95.079681][ T5314] CPU0 CPU1 [ 95.081698][ T5314] ---- ---- [ 95.083878][ T5314] lock(&gi->lock); [ 95.085556][ T5314] lock(&sb->s_type->i_mutex_key#24); [ 95.088995][ T5314] lock(&gi->lock); [ 95.091805][ T5314] lock(tpg_instances_lock); [ 95.093870][ T5314] [ 95.093870][ T5314] *** DEADLOCK *** [ 95.093870][ T5314] [ 95.097411][ T5314] locks held by syz.0.0/5314: 3, last CPU#0: [ 95.099990][ T5314] #0: ffff888000f18460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.103976][ T5314] #1: ffff8880123ac140 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x4d0/0x11d0 [ 95.109697][ T5314] #2: ffff88803ed66390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 95.114024][ T5314] [ 95.114024][ T5314] stack backtrace: [ 95.116596][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.120246][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.124264][ T5314] Call Trace: [ 95.125780][ T5314] [ 95.127114][ T5314] dump_stack_lvl+0xe8/0x150 [ 95.129251][ T5314] print_circular_bug+0x2e2/0x300 [ 95.131492][ T5314] check_noncircular+0x12f/0x150 [ 95.133642][ T5314] __lock_acquire+0x164c/0x2de0 [ 95.135825][ T5314] ? __lock_acquire+0x1511/0x2de0 [ 95.138047][ T5314] lock_acquire+0x115/0x350 [ 95.140154][ T5314] ? tcm_alloc+0x21/0x2e0 [ 95.142107][ T5314] __mutex_lock+0x19d/0x1550 [ 95.144180][ T5314] ? tcm_alloc+0x21/0x2e0 [ 95.146141][ T5314] ? trace_contention_end+0x3d/0x140 [ 95.148424][ T5314] ? __mutex_lock+0x30b/0x1550 [ 95.150485][ T5314] ? tcm_alloc+0x21/0x2e0 [ 95.152426][ T5314] ? __pfx___mutex_lock+0x10/0x10 [ 95.154754][ T5314] ? lock_acquire+0x115/0x350 [ 95.156818][ T5314] ? __pfx___mutex_lock+0x10/0x10 [ 95.159090][ T5314] tcm_alloc+0x21/0x2e0 [ 95.160952][ T5314] usb_get_function+0x63/0xb0 [ 95.163094][ T5314] config_usb_cfg_link+0x148/0x260 [ 95.165380][ T5314] configfs_symlink+0x74e/0x11d0 [ 95.167652][ T5314] ? lookup_one_qstr_excl+0x1d4/0x360 [ 95.170054][ T5314] ? make_vfsuid+0x49/0xa0 [ 95.171919][ T5314] ? generic_permission+0x2bf/0x670 [ 95.174119][ T5314] ? __pfx_configfs_symlink+0x10/0x10 [ 95.176401][ T5314] ? bpf_lsm_inode_symlink+0x9/0x20 [ 95.178585][ T5314] vfs_symlink+0x18b/0x330 [ 95.180419][ T5314] ? security_path_symlink+0xfd/0x360 [ 95.182651][ T5314] filename_symlinkat+0x1cd/0x410 [ 95.184884][ T5314] ? __pfx_filename_symlinkat+0x10/0x10 [ 95.187247][ T5314] ? do_getname+0x151/0x250 [ 95.189175][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 95.191402][ T5314] do_syscall_64+0x166/0x520 [ 95.193455][ T5314] ? trace_irq_disable+0x3b/0x140 [ 95.195744][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.198454][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 95.200625][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.203240][ T5314] RIP: 0033:0x7f019bd9e159 [ 95.205238][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.213263][ T5314] RSP: 002b:00007f019cc6efe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 95.216813][ T5314] RAX: ffffffffffffffda RBX: 00007f019c025fa0 RCX: 00007f019bd9e159 [ 95.220188][ T5314] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 95.223605][ T5314] RBP: 00007f019be3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.226943][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.230564][ T5314] R13: 00007f019c026038 R14: 00007f019c025fa0 R15: 00007ffc9ce3e4b8 [ 95.234235][ T5314] [ 95.482971][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd