program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x1}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) [ 93.411914][ T4642] Bluetooth: hci0: command tx timeout [ 93.434868][ T936] cfg80211: failed to load regulatory.db [ 93.542692][ T5319] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 93.581168][ T5319] [ 93.582478][ T5319] ====================================================== [ 93.585371][ T5319] WARNING: possible circular locking dependency detected [ 93.588330][ T5319] syzkaller #0 Not tainted [ 93.590192][ T5319] ------------------------------------------------------ [ 93.593050][ T5319] syz.0.0/5319 is trying to acquire lock: [ 93.595605][ T5319] ffffffff8fc71de0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 93.599497][ T5319] [ 93.599497][ T5319] but task is already holding lock: [ 93.602670][ T5319] ffff888013074390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 93.606248][ T5319] [ 93.606248][ T5319] which lock already depends on the new lock. [ 93.606248][ T5319] [ 93.609855][ T5319] [ 93.609855][ T5319] the existing dependency chain (in reverse order) is: [ 93.612810][ T5319] [ 93.612810][ T5319] -> #2 (&gi->lock){+.+.}-{4:4}: [ 93.615349][ T5319] __mutex_lock+0x19d/0x1550 [ 93.617181][ T5319] config_usb_cfg_link+0x59/0x260 [ 93.619473][ T5319] configfs_symlink+0x74e/0x11d0 [ 93.621799][ T5319] vfs_symlink+0x18b/0x330 [ 93.623990][ T5319] filename_symlinkat+0x1cd/0x410 [ 93.626470][ T5319] __se_sys_symlinkat+0x4e/0x2b0 [ 93.628771][ T5319] do_syscall_64+0x166/0x520 [ 93.630816][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.633574][ T5319] [ 93.633574][ T5319] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 93.637203][ T5319] down_write+0x96/0x200 [ 93.639320][ T5319] configfs_depend_item_unlocked+0x153/0x420 [ 93.642253][ T5319] usbg_make_tpg+0x1e0/0x550 [ 93.644744][ T5319] target_fabric_make_tpg+0xa8/0x6d0 [ 93.647260][ T5319] configfs_mkdir+0x4f6/0x9e0 [ 93.649340][ T5319] vfs_mkdir+0x40c/0x620 [ 93.651361][ T5319] filename_mkdirat+0x285/0x510 [ 93.653908][ T5319] __se_sys_mkdirat+0x35/0x150 [ 93.656339][ T5319] do_syscall_64+0x166/0x520 [ 93.658601][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.661413][ T5319] [ 93.661413][ T5319] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 93.664805][ T5319] __lock_acquire+0x164c/0x2de0 [ 93.667139][ T5319] lock_acquire+0x115/0x350 [ 93.669333][ T5319] __mutex_lock+0x19d/0x1550 [ 93.671810][ T5319] tcm_alloc+0x21/0x2e0 [ 93.673943][ T5319] usb_get_function+0x63/0xb0 [ 93.676133][ T5319] config_usb_cfg_link+0x148/0x260 [ 93.678303][ T5319] configfs_symlink+0x74e/0x11d0 [ 93.680679][ T5319] vfs_symlink+0x18b/0x330 [ 93.683054][ T5319] filename_symlinkat+0x1cd/0x410 [ 93.685501][ T5319] __se_sys_symlinkat+0x4e/0x2b0 [ 93.687921][ T5319] do_syscall_64+0x166/0x520 [ 93.690680][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.693873][ T5319] [ 93.693873][ T5319] other info that might help us debug this: [ 93.693873][ T5319] [ 93.698230][ T5319] Chain exists of: [ 93.698230][ T5319] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 93.698230][ T5319] [ 93.704225][ T5319] Possible unsafe locking scenario: [ 93.704225][ T5319] [ 93.708683][ T5319] CPU0 CPU1 [ 93.711126][ T5319] ---- ---- [ 93.713473][ T5319] lock(&gi->lock); [ 93.715259][ T5319] lock(&sb->s_type->i_mutex_key#24); [ 93.718683][ T5319] lock(&gi->lock); [ 93.721633][ T5319] lock(tpg_instances_lock); [ 93.723882][ T5319] [ 93.723882][ T5319] *** DEADLOCK *** [ 93.723882][ T5319] [ 93.727530][ T5319] locks held by syz.0.0/5319: 3, last CPU#0: [ 93.730272][ T5319] #0: ffff888000f08460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 93.734337][ T5319] #1: ffff88801fca0600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x4d0/0x11d0 [ 93.738656][ T5319] #2: ffff888013074390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 93.742504][ T5319] [ 93.742504][ T5319] stack backtrace: [ 93.745171][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.749446][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.754069][ T5319] Call Trace: [ 93.755604][ T5319] [ 93.756989][ T5319] dump_stack_lvl+0xe8/0x150 [ 93.759153][ T5319] print_circular_bug+0x2e2/0x300 [ 93.761456][ T5319] check_noncircular+0x12f/0x150 [ 93.763720][ T5319] __lock_acquire+0x164c/0x2de0 [ 93.765780][ T5319] ? __lock_acquire+0x1511/0x2de0 [ 93.767833][ T5319] lock_acquire+0x115/0x350 [ 93.769805][ T5319] ? tcm_alloc+0x21/0x2e0 [ 93.771601][ T5319] __mutex_lock+0x19d/0x1550 [ 93.773808][ T5319] ? tcm_alloc+0x21/0x2e0 [ 93.775772][ T5319] ? trace_contention_end+0x3d/0x140 [ 93.778141][ T5319] ? __mutex_lock+0x30b/0x1550 [ 93.780289][ T5319] ? tcm_alloc+0x21/0x2e0 [ 93.782310][ T5319] ? __pfx___mutex_lock+0x10/0x10 [ 93.784626][ T5319] ? lock_acquire+0x115/0x350 [ 93.786773][ T5319] ? __pfx___mutex_lock+0x10/0x10 [ 93.788937][ T5319] tcm_alloc+0x21/0x2e0 [ 93.790860][ T5319] usb_get_function+0x63/0xb0 [ 93.792979][ T5319] config_usb_cfg_link+0x148/0x260 [ 93.795284][ T5319] configfs_symlink+0x74e/0x11d0 [ 93.797542][ T5319] ? lookup_one_qstr_excl+0x1d4/0x360 [ 93.799912][ T5319] ? make_vfsuid+0x49/0xa0 [ 93.801896][ T5319] ? generic_permission+0x2bf/0x670 [ 93.804247][ T5319] ? __pfx_configfs_symlink+0x10/0x10 [ 93.806581][ T5319] ? bpf_lsm_inode_symlink+0x9/0x20 [ 93.808898][ T5319] vfs_symlink+0x18b/0x330 [ 93.810936][ T5319] ? security_path_symlink+0xfd/0x360 [ 93.813460][ T5319] filename_symlinkat+0x1cd/0x410 [ 93.815710][ T5319] ? __pfx_filename_symlinkat+0x10/0x10 [ 93.818166][ T5319] ? do_getname+0x151/0x250 [ 93.820090][ T5319] __se_sys_symlinkat+0x4e/0x2b0 [ 93.822310][ T5319] do_syscall_64+0x166/0x520 [ 93.824370][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.827080][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 93.829094][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.831591][ T5319] RIP: 0033:0x7f958499e159 [ 93.833647][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.841839][ T5319] RSP: 002b:00007f9580df4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 93.845417][ T5319] RAX: ffffffffffffffda RBX: 00007f9584c25fa0 RCX: 00007f958499e159 [ 93.848840][ T5319] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 93.852175][ T5319] RBP: 00007f9584a3506b R08: 0000000000000000 R09: 0000000000000000 [ 93.855673][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.859113][ T5319] R13: 00007f9584c26038 R14: 00007f9584c25fa0 R15: 00007ffc4229ae48 [ 93.862585][ T5319] [ 94.116985][ T936] usb 5-1: new high-speed USB device number 2 using dummy_hcd