program: mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x19, 0x4, 0x8, 0x8, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7fff}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1\x00', 0x1, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8001, 0x0, 0x8, 0x0) write(r1, &(0x7f0000000a00)='rd_pages=8', 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./myconfig/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0\x00', 0x1ff) symlinkat(&(0x7f0000000800)='./myconfig/usb_gadget/g1/strings/0x409/s1\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./myconfig/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0/str\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000c00)='1', 0x1) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') [ 132.809457][ T5338] [ 132.810602][ T5338] ====================================================== [ 132.813676][ T5338] WARNING: possible circular locking dependency detected [ 132.816646][ T5338] syzkaller #0 Not tainted [ 132.818669][ T5338] ------------------------------------------------------ [ 132.821481][ T5338] syz.0.0/5338 is trying to acquire lock: [ 132.823839][ T5338] ffffffff8f9ed628 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_extension_allow_link+0x6c/0x1f0 [ 132.828452][ T5338] [ 132.828452][ T5338] but task is already holding lock: [ 132.831603][ T5338] ffff888012351900 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 132.836101][ T5338] [ 132.836101][ T5338] which lock already depends on the new lock. [ 132.836101][ T5338] [ 132.840600][ T5338] [ 132.840600][ T5338] the existing dependency chain (in reverse order) is: [ 132.844360][ T5338] [ 132.844360][ T5338] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 132.848023][ T5338] down_write+0x96/0x200 [ 132.850115][ T5338] configfs_depend_item_unlocked+0x153/0x420 [ 132.852910][ T5338] usbg_make_tpg+0x1f6/0x590 [ 132.855081][ T5338] target_fabric_make_tpg+0xa8/0x6d0 [ 132.857680][ T5338] configfs_mkdir+0x4f6/0x9e0 [ 132.859957][ T5338] vfs_mkdir+0x406/0x620 [ 132.862046][ T5338] filename_mkdirat+0x285/0x510 [ 132.864338][ T5338] __se_sys_mkdir+0x34/0x150 [ 132.866544][ T5338] do_syscall_64+0x174/0x580 [ 132.868826][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.871436][ T5338] [ 132.871436][ T5338] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 132.874620][ T5338] __mutex_lock+0x19d/0x1550 [ 132.876834][ T5338] tcm_set_name+0x2b/0xd0 [ 132.878843][ T5338] function_make+0x1a8/0x360 [ 132.881047][ T5338] configfs_mkdir+0x4f6/0x9e0 [ 132.883239][ T5338] vfs_mkdir+0x406/0x620 [ 132.885189][ T5338] filename_mkdirat+0x285/0x510 [ 132.887347][ T5338] __se_sys_mkdir+0x34/0x150 [ 132.890102][ T5338] do_syscall_64+0x174/0x580 [ 132.892394][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.895218][ T5338] [ 132.895218][ T5338] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 132.899045][ T5338] __lock_acquire+0x1520/0x2cf0 [ 132.902059][ T5338] lock_acquire+0x106/0x350 [ 132.904901][ T5338] __mutex_lock+0x19d/0x1550 [ 132.907113][ T5338] uvcg_extension_allow_link+0x6c/0x1f0 [ 132.909689][ T5338] configfs_symlink+0x59a/0x1030 [ 132.912006][ T5338] vfs_symlink+0x18b/0x330 [ 132.914144][ T5338] filename_symlinkat+0x1cd/0x410 [ 132.916513][ T5338] __se_sys_symlinkat+0x4e/0x2b0 [ 132.919007][ T5338] do_syscall_64+0x174/0x580 [ 132.922193][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.924545][ T5338] [ 132.924545][ T5338] other info that might help us debug this: [ 132.924545][ T5338] [ 132.928502][ T5338] Chain exists of: [ 132.928502][ T5338] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 132.928502][ T5338] [ 132.934369][ T5338] Possible unsafe locking scenario: [ 132.934369][ T5338] [ 132.937426][ T5338] CPU0 CPU1 [ 132.939492][ T5338] ---- ---- [ 132.941788][ T5338] lock(&sb->s_type->i_mutex_key#24); [ 132.944045][ T5338] lock(&opts->dep_lock); [ 132.946940][ T5338] lock(&sb->s_type->i_mutex_key#24); [ 132.950106][ T5338] lock(gadget_subsys.su_mutex); [ 132.952085][ T5338] [ 132.952085][ T5338] *** DEADLOCK *** [ 132.952085][ T5338] [ 132.955175][ T5338] 2 locks held by syz.0.0/5338: [ 132.957217][ T5338] #0: ffff888000b50450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 132.961057][ T5338] #1: ffff888012351900 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 132.965626][ T5338] [ 132.965626][ T5338] stack backtrace: [ 132.968101][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 132.968116][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.968124][ T5338] Call Trace: [ 132.968132][ T5338] [ 132.968137][ T5338] dump_stack_lvl+0xe8/0x150 [ 132.968158][ T5338] print_circular_bug+0x2e1/0x300 [ 132.968177][ T5338] check_noncircular+0x12e/0x150 [ 132.968194][ T5338] __lock_acquire+0x1520/0x2cf0 [ 132.968211][ T5338] ? stack_trace_save+0xa9/0x100 [ 132.968250][ T5338] ? __pfx_stack_trace_save+0x10/0x10 [ 132.968265][ T5338] ? check_path+0x21/0x40 [ 132.968281][ T5338] ? check_noncircular+0xda/0x150 [ 132.968299][ T5338] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 132.968315][ T5338] lock_acquire+0x106/0x350 [ 132.968329][ T5338] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 132.968346][ T5338] __mutex_lock+0x19d/0x1550 [ 132.968362][ T5338] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 132.968379][ T5338] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 132.968395][ T5338] ? __pfx___mutex_lock+0x10/0x10 [ 132.968409][ T5338] ? generic_permission+0x2bf/0x670 [ 132.968423][ T5338] uvcg_extension_allow_link+0x6c/0x1f0 [ 132.968439][ T5338] configfs_symlink+0x59a/0x1030 [ 132.968456][ T5338] ? lookup_one_qstr_excl+0x1d4/0x360 [ 132.968470][ T5338] ? make_vfsuid+0x49/0xa0 [ 132.968487][ T5338] ? __pfx_configfs_symlink+0x10/0x10 [ 132.968504][ T5338] ? bpf_lsm_inode_symlink+0x9/0x20 [ 132.968520][ T5338] vfs_symlink+0x18b/0x330 [ 132.968536][ T5338] ? security_path_symlink+0xfd/0x360 [ 132.968554][ T5338] filename_symlinkat+0x1cd/0x410 [ 132.968573][ T5338] ? __pfx_filename_symlinkat+0x10/0x10 [ 132.968591][ T5338] ? do_getname+0x151/0x250 [ 132.968601][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.968613][ T5338] __se_sys_symlinkat+0x4e/0x2b0 [ 132.968629][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.968640][ T5338] do_syscall_64+0x174/0x580 [ 132.968654][ T5338] ? clear_bhb_loop+0x70/0xc0 [ 132.968667][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.968678][ T5338] RIP: 0033:0x7f771679e0d9 [ 132.968703][ T5338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.968714][ T5338] RSP: 002b:00007f771774bfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 132.968728][ T5338] RAX: ffffffffffffffda RBX: 00007f7716a25fa0 RCX: 00007f771679e0d9 [ 132.968736][ T5338] RDX: 0000200000000900 RSI: ffffffffffffff9c RDI: 0000200000000800 [ 132.968744][ T5338] RBP: 00007f7716835024 R08: 0000000000000000 R09: 0000000000000000 [ 132.968751][ T5338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.968758][ T5338] R13: 00007f7716a26038 R14: 00007f7716a25fa0 R15: 00007ffdaff1ee08 [ 132.968768][ T5338] [ 133.089641][ T5303] Bluetooth: hci0: command tx timeout [ 133.103016][ T5339] se_device not configured yet, cannot port link