program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='rd_pages=1024\n\x00', 0xf) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/dev0/enable\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n\x00', 0x3) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000000440)='naa.6001405123456780\n\x00', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='1\n\x00', 0x3) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000600)='dummy_udc.0\n\x00', 0xd) close(r4) nanosleep(&(0x7f0000000640)={0x1}, 0x0) syz_open_dev$sg(&(0x7f0000000680), 0x0, 0x2) r5 = syz_open_dev$sg(&(0x7f0000000680), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000680), 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./payload\x00', 0x42, 0x1ff) write(r6, &(0x7f0000001000)="000000000000000011223344556677880000000000000000", 0x18) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000800)={0x0, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x18, &(0x7f0000001000)=""/24}, &(0x7f0000002000)="5f000000000000001800", &(0x7f0000003000)=""/32, 0x1388, 0x0, 0x0, 0x0}) [ 75.187451][ T4648] Bluetooth: hci0: command tx timeout [ 75.321902][ T5314] [ 75.322957][ T5314] ====================================================== [ 75.325802][ T5314] WARNING: possible circular locking dependency detected [ 75.328592][ T5314] syzkaller #0 Not tainted [ 75.330487][ T5314] ------------------------------------------------------ [ 75.333269][ T5314] syz.0.0/5314 is trying to acquire lock: [ 75.335741][ T5314] ffff888000437a40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 75.340796][ T5314] [ 75.340796][ T5314] but task is already holding lock: [ 75.344083][ T5314] ffffffff8fc72ac0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 75.348389][ T5314] [ 75.348389][ T5314] which lock already depends on the new lock. [ 75.348389][ T5314] [ 75.353039][ T5314] [ 75.353039][ T5314] the existing dependency chain (in reverse order) is: [ 75.357019][ T5314] [ 75.357019][ T5314] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 75.360488][ T5314] __mutex_lock+0x19d/0x1550 [ 75.362867][ T5314] tcm_alloc+0x21/0x2e0 [ 75.364948][ T5314] usb_get_function+0x63/0xb0 [ 75.367233][ T5314] config_usb_cfg_link+0x148/0x260 [ 75.369747][ T5314] configfs_symlink+0x74e/0x11d0 [ 75.372217][ T5314] vfs_symlink+0x18b/0x330 [ 75.374521][ T5314] filename_symlinkat+0x1cd/0x410 [ 75.376968][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 75.379402][ T5314] do_syscall_64+0x166/0x520 [ 75.381799][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.384695][ T5314] [ 75.384695][ T5314] -> #1 (&gi->lock){+.+.}-{4:4}: [ 75.387831][ T5314] __mutex_lock+0x19d/0x1550 [ 75.390096][ T5314] config_usb_cfg_link+0x59/0x260 [ 75.392328][ T5314] configfs_symlink+0x74e/0x11d0 [ 75.394555][ T5314] vfs_symlink+0x18b/0x330 [ 75.396546][ T5314] filename_symlinkat+0x1cd/0x410 [ 75.398838][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 75.401249][ T5314] do_syscall_64+0x166/0x520 [ 75.403476][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.406255][ T5314] [ 75.406255][ T5314] -> #0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 75.410167][ T5314] __lock_acquire+0x164c/0x2de0 [ 75.412512][ T5314] lock_acquire+0x115/0x350 [ 75.414611][ T5314] down_write+0x96/0x200 [ 75.416800][ T5314] configfs_depend_item_unlocked+0x153/0x420 [ 75.419698][ T5314] usbg_make_tpg+0x1e0/0x550 [ 75.422080][ T5314] target_fabric_make_tpg+0xa8/0x6d0 [ 75.424829][ T5314] configfs_mkdir+0x4f6/0x9e0 [ 75.427142][ T5314] vfs_mkdir+0x40c/0x620 [ 75.429364][ T5314] filename_mkdirat+0x285/0x510 [ 75.431862][ T5314] __se_sys_mkdirat+0x35/0x150 [ 75.434273][ T5314] do_syscall_64+0x166/0x520 [ 75.436603][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.439421][ T5314] [ 75.439421][ T5314] other info that might help us debug this: [ 75.439421][ T5314] [ 75.443793][ T5314] Chain exists of: [ 75.443793][ T5314] &sb->s_type->i_mutex_key#24 --> &gi->lock --> tpg_instances_lock [ 75.443793][ T5314] [ 75.450160][ T5314] Possible unsafe locking scenario: [ 75.450160][ T5314] [ 75.453529][ T5314] CPU0 CPU1 [ 75.456058][ T5314] ---- ---- [ 75.458601][ T5314] lock(tpg_instances_lock); [ 75.460896][ T5314] lock(&gi->lock); [ 75.464423][ T5314] lock(tpg_instances_lock); [ 75.467804][ T5314] lock(&sb->s_type->i_mutex_key#24); [ 75.470330][ T5314] [ 75.470330][ T5314] *** DEADLOCK *** [ 75.470330][ T5314] [ 75.474051][ T5314] locks held by syz.0.0/5314: 4, last CPU#0: [ 75.476794][ T5314] #0: ffff8880003e6460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 75.481035][ T5314] #1: ffff88801fc6d900 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 75.485857][ T5314] #2: ffffffff8f93d288 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 75.490681][ T5314] #3: ffffffff8fc72ac0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 75.494988][ T5314] [ 75.494988][ T5314] stack backtrace: [ 75.497508][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.501515][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.506092][ T5314] Call Trace: [ 75.507560][ T5314] [ 75.508891][ T5314] dump_stack_lvl+0xe8/0x150 [ 75.510957][ T5314] print_circular_bug+0x2e2/0x300 [ 75.513176][ T5314] check_noncircular+0x12f/0x150 [ 75.515424][ T5314] __lock_acquire+0x164c/0x2de0 [ 75.517643][ T5314] ? __mutex_trylock_common+0x15f/0x270 [ 75.520173][ T5314] ? __pfx___mutex_trylock_common+0x10/0x10 [ 75.522796][ T5314] ? rcu_is_watching+0x16/0xb0 [ 75.524954][ T5314] lock_acquire+0x115/0x350 [ 75.527058][ T5314] ? configfs_depend_item_unlocked+0x153/0x420 [ 75.529988][ T5314] down_write+0x96/0x200 [ 75.531943][ T5314] ? configfs_depend_item_unlocked+0x153/0x420 [ 75.534784][ T5314] ? __pfx_down_write+0x10/0x10 [ 75.537008][ T5314] ? kstrtoull+0x137/0x1d0 [ 75.538952][ T5314] configfs_depend_item_unlocked+0x153/0x420 [ 75.541637][ T5314] usbg_make_tpg+0x1e0/0x550 [ 75.543697][ T5314] ? configfs_mkdir+0x4b0/0x9e0 [ 75.545882][ T5314] ? __pfx___mutex_lock+0x10/0x10 [ 75.548086][ T5314] ? __pfx_usbg_make_tpg+0x10/0x10 [ 75.550401][ T5314] ? do_raw_spin_lock+0x12b/0x2f0 [ 75.552637][ T5314] target_fabric_make_tpg+0xa8/0x6d0 [ 75.555214][ T5314] configfs_mkdir+0x4f6/0x9e0 [ 75.557279][ T5314] ? d_splice_alias+0x12/0x30 [ 75.559417][ T5314] ? __pfx_configfs_mkdir+0x10/0x10 [ 75.561757][ T5314] ? generic_permission+0x2bf/0x670 [ 75.563962][ T5314] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 75.566263][ T5314] vfs_mkdir+0x40c/0x620 [ 75.568067][ T5314] filename_mkdirat+0x285/0x510 [ 75.570277][ T5314] ? __pfx_filename_mkdirat+0x10/0x10 [ 75.572585][ T5314] ? do_getname+0x151/0x250 [ 75.574560][ T5314] __se_sys_mkdirat+0x35/0x150 [ 75.576725][ T5314] do_syscall_64+0x166/0x520 [ 75.578719][ T5314] ? trace_irq_disable+0x3b/0x140 [ 75.580965][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.583681][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 75.585855][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.588529][ T5314] RIP: 0033:0x7f4fbe59e159 [ 75.590551][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.598964][ T5314] RSP: 002b:00007f4fbf3c8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 75.602674][ T5314] RAX: ffffffffffffffda RBX: 00007f4fbe825fa0 RCX: 00007f4fbe59e159 [ 75.606301][ T5314] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 75.609799][ T5314] RBP: 00007f4fbe63506b R08: 0000000000000000 R09: 0000000000000000 [ 75.613420][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.617064][ T5314] R13: 00007f4fbe826038 R14: 00007f4fbe825fa0 R15: 00007ffc11e03978 [ 75.620591][ T5314]