program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405bd4e49776\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405bd4e49776/tpgt_1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405bd4e49776/tpgt_1/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='1', 0x1) close(r0) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='dummy_udc.0', 0xb) close(r1) nanosleep(&(0x7f0000000500)={0x2}, 0x0) [ 85.533904][ T4649] Bluetooth: hci0: command tx timeout [ 85.539306][ T5322] [ 85.542738][ T5322] ====================================================== [ 85.545571][ T5322] WARNING: possible circular locking dependency detected [ 85.549612][ T5322] syzkaller #0 Not tainted [ 85.551304][ T5322] ------------------------------------------------------ [ 85.554112][ T5322] syz.0.0/5322 is trying to acquire lock: [ 85.556569][ T5322] ffffffff8fc734a0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 85.560568][ T5322] [ 85.560568][ T5322] but task is already holding lock: [ 85.563738][ T5322] ffff8880131c0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.567566][ T5322] [ 85.567566][ T5322] which lock already depends on the new lock. [ 85.567566][ T5322] [ 85.572151][ T5322] [ 85.572151][ T5322] the existing dependency chain (in reverse order) is: [ 85.575993][ T5322] [ 85.575993][ T5322] -> #2 (&gi->lock){+.+.}-{4:4}: [ 85.579004][ T5322] __mutex_lock+0x19d/0x1550 [ 85.581317][ T5322] config_usb_cfg_link+0x59/0x260 [ 85.583420][ T5322] configfs_symlink+0x74e/0x11d0 [ 85.585695][ T5322] vfs_symlink+0x18b/0x330 [ 85.587781][ T5322] filename_symlinkat+0x1cd/0x410 [ 85.590029][ T5322] __se_sys_symlinkat+0x4e/0x2b0 [ 85.592243][ T5322] do_syscall_64+0x166/0x520 [ 85.594321][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.596894][ T5322] [ 85.596894][ T5322] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 85.601795][ T5322] down_write+0x96/0x200 [ 85.603698][ T5322] configfs_depend_item_unlocked+0x153/0x420 [ 85.606184][ T5322] usbg_make_tpg+0x1e0/0x550 [ 85.608268][ T5322] target_fabric_make_tpg+0xa8/0x6d0 [ 85.613151][ T5322] configfs_mkdir+0x4f6/0x9e0 [ 85.615268][ T5322] vfs_mkdir+0x40c/0x620 [ 85.617238][ T5322] filename_mkdirat+0x285/0x510 [ 85.619426][ T5322] __se_sys_mkdirat+0x35/0x150 [ 85.621615][ T5322] do_syscall_64+0x166/0x520 [ 85.623690][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.626189][ T5322] [ 85.626189][ T5322] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 85.629464][ T5322] __lock_acquire+0x164c/0x2de0 [ 85.631595][ T5322] lock_acquire+0x115/0x350 [ 85.633759][ T5322] __mutex_lock+0x19d/0x1550 [ 85.635923][ T5322] tcm_alloc+0x21/0x2e0 [ 85.637932][ T5322] usb_get_function+0x63/0xb0 [ 85.639982][ T5322] config_usb_cfg_link+0x148/0x260 [ 85.642441][ T5322] configfs_symlink+0x74e/0x11d0 [ 85.644691][ T5322] vfs_symlink+0x18b/0x330 [ 85.646762][ T5322] filename_symlinkat+0x1cd/0x410 [ 85.649102][ T5322] __se_sys_symlinkat+0x4e/0x2b0 [ 85.651415][ T5322] do_syscall_64+0x166/0x520 [ 85.653635][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.656380][ T5322] [ 85.656380][ T5322] other info that might help us debug this: [ 85.656380][ T5322] [ 85.660617][ T5322] Chain exists of: [ 85.660617][ T5322] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 85.660617][ T5322] [ 85.666181][ T5322] Possible unsafe locking scenario: [ 85.666181][ T5322] [ 85.669203][ T5322] CPU0 CPU1 [ 85.671526][ T5322] ---- ---- [ 85.673652][ T5322] lock(&gi->lock); [ 85.675174][ T5322] lock(&sb->s_type->i_mutex_key#24); [ 85.678401][ T5322] lock(&gi->lock); [ 85.681104][ T5322] lock(tpg_instances_lock); [ 85.683135][ T5322] [ 85.683135][ T5322] *** DEADLOCK *** [ 85.683135][ T5322] [ 85.686614][ T5322] locks held by syz.0.0/5322: 3, last CPU#0: [ 85.689187][ T5322] #0: ffff888000bd6460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 85.693096][ T5322] #1: ffff888011f44600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x4d0/0x11d0 [ 85.697715][ T5322] #2: ffff8880131c0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.701732][ T5322] [ 85.701732][ T5322] stack backtrace: [ 85.704332][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.708118][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.712003][ T5322] Call Trace: [ 85.720463][ T5322] [ 85.721826][ T5322] dump_stack_lvl+0xe8/0x150 [ 85.725357][ T5322] print_circular_bug+0x2e2/0x300 [ 85.727557][ T5322] check_noncircular+0x12f/0x150 [ 85.729774][ T5322] __lock_acquire+0x164c/0x2de0 [ 85.731902][ T5322] ? __lock_acquire+0x1511/0x2de0 [ 85.734116][ T5322] lock_acquire+0x115/0x350 [ 85.736050][ T5322] ? tcm_alloc+0x21/0x2e0 [ 85.737972][ T5322] __mutex_lock+0x19d/0x1550 [ 85.739984][ T5322] ? tcm_alloc+0x21/0x2e0 [ 85.741882][ T5322] ? trace_contention_end+0x3d/0x140 [ 85.744079][ T5322] ? __mutex_lock+0x30b/0x1550 [ 85.746153][ T5322] ? tcm_alloc+0x21/0x2e0 [ 85.747972][ T5322] ? __pfx___mutex_lock+0x10/0x10 [ 85.750056][ T5322] ? lock_acquire+0x115/0x350 [ 85.752096][ T5322] ? __pfx___mutex_lock+0x10/0x10 [ 85.754274][ T5322] tcm_alloc+0x21/0x2e0 [ 85.756001][ T5322] usb_get_function+0x63/0xb0 [ 85.757978][ T5322] config_usb_cfg_link+0x148/0x260 [ 85.760136][ T5322] configfs_symlink+0x74e/0x11d0 [ 85.762336][ T5322] ? lookup_one_qstr_excl+0x1d4/0x360 [ 85.764661][ T5322] ? make_vfsuid+0x49/0xa0 [ 85.766573][ T5322] ? generic_permission+0x2bf/0x670 [ 85.768821][ T5322] ? __pfx_configfs_symlink+0x10/0x10 [ 85.771126][ T5322] ? bpf_lsm_inode_symlink+0x9/0x20 [ 85.773302][ T5322] vfs_symlink+0x18b/0x330 [ 85.775193][ T5322] ? security_path_symlink+0xfd/0x360 [ 85.777513][ T5322] filename_symlinkat+0x1cd/0x410 [ 85.779642][ T5322] ? __pfx_filename_symlinkat+0x10/0x10 [ 85.781818][ T5322] ? do_getname+0x151/0x250 [ 85.783686][ T5322] __se_sys_symlinkat+0x4e/0x2b0 [ 85.785674][ T5322] do_syscall_64+0x166/0x520 [ 85.787378][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.789840][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 85.791892][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.794407][ T5322] RIP: 0033:0x7fa6b259e159 [ 85.796302][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.804370][ T5322] RSP: 002b:00007fa6b34effe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 85.807572][ T5322] RAX: ffffffffffffffda RBX: 00007fa6b2825fa0 RCX: 00007fa6b259e159 [ 85.810905][ T5322] RDX: 00002000000003c0 RSI: ffffffffffffff9c RDI: 0000200000000380 [ 85.814052][ T5322] RBP: 00007fa6b263506b R08: 0000000000000000 R09: 0000000000000000 [ 85.817225][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.820377][ T5322] R13: 00007fa6b2826038 R14: 00007fa6b2825fa0 R15: 00007ffea6ee7368 [ 85.823686][ T5322] [ 86.094304][ T1368] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.244440][ T1368] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 86.246385][ T1368] usb 5-1: Dual-Role OTG device on HNP port [ 86.246683][ T1368] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.250759][ T9] Using the BOT protocol [ 86.271540][ T9] Using the UAS protocol [ 86.291918][ T1368] scsi host6: uas [ 86.313469][ C0] Missing nexus, ignoring command