program: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in6={0xa, 0x4e24, 0xf3, @loopback, 0x3}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3c}}], 0x2c) (async) connect$pptp(r0, &(0x7f0000000480)={0x18, 0x2, {0x1, @rand_addr=0x64010102}}, 0x1e) sendmsg$inet_sctp(r0, &(0x7f00000005c0)={&(0x7f0000000600)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000640)=[{&(0x7f0000000680)="e6", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084000000080000002001000000000000000000000000000020"], 0x58, 0x4855}, 0x24000052) (async) mkdir(&(0x7f0000000040)='./my_configfs\x00', 0x1ff) (async) mount(0x0, &(0x7f00000000c0)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f00000004c0), 0x0, 0x2) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) (async) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) (async) syz_open_dev$ndb(&(0x7f0000000540), 0x0, 0x140) (async) mkdir(&(0x7f0000000140)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000180)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f00000001c0)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000200)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a1c000000030a030000000000000000000200000308000540000000000700000a"], 0x44}}, 0x20008840) rmdir(&(0x7f0000000700)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00') (async) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) (async) rmdir(&(0x7f0000000280)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) [ 101.470480][ T4643] Bluetooth: hci0: command tx timeout [ 101.629317][ T5324] [ 101.630486][ T5324] ====================================================== [ 101.633617][ T5324] WARNING: possible circular locking dependency detected [ 101.636716][ T5324] syzkaller #0 Not tainted [ 101.638671][ T5324] ------------------------------------------------------ [ 101.641536][ T5324] syz.0.0/5324 is trying to acquire lock: [ 101.643931][ T5324] ffff888032066c00 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 101.648720][ T5324] [ 101.648720][ T5324] but task is already holding lock: [ 101.651720][ T5324] ffffffff90c740c0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 101.655558][ T5324] [ 101.655558][ T5324] which lock already depends on the new lock. [ 101.655558][ T5324] [ 101.659873][ T5324] [ 101.659873][ T5324] the existing dependency chain (in reverse order) is: [ 101.663619][ T5324] [ 101.663619][ T5324] -> #3 (tpg_instances_lock){+.+.}-{4:4}: [ 101.666987][ T5324] __mutex_lock+0x19d/0x1550 [ 101.669276][ T5324] tcm_alloc_inst+0x65/0x1a0 [ 101.671480][ T5324] usb_get_function_instance+0xe3/0x2f0 [ 101.673998][ T5324] function_make+0x127/0x360 [ 101.676109][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 101.678341][ T5324] vfs_mkdir+0x40c/0x620 [ 101.680372][ T5324] filename_mkdirat+0x285/0x510 [ 101.682586][ T5324] __se_sys_mkdir+0x34/0x150 [ 101.684786][ T5324] do_syscall_64+0x166/0x520 [ 101.686925][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.689557][ T5324] [ 101.689557][ T5324] -> #2 (func_lock){+.+.}-{4:4}: [ 101.692004][ T5324] __mutex_lock+0x19d/0x1550 [ 101.693711][ T5324] usb_get_function_instance+0x2e/0x2f0 [ 101.695775][ T5324] function_make+0x127/0x360 [ 101.697792][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 101.699775][ T5324] vfs_mkdir+0x40c/0x620 [ 101.701804][ T5324] filename_mkdirat+0x285/0x510 [ 101.704105][ T5324] __se_sys_mkdir+0x34/0x150 [ 101.706307][ T5324] do_syscall_64+0x166/0x520 [ 101.708503][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.711274][ T5324] [ 101.711274][ T5324] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 101.714827][ T5324] __mutex_lock+0x19d/0x1550 [ 101.717045][ T5324] configfs_rmdir+0x5f0/0x950 [ 101.719124][ T5324] vfs_rmdir+0x3e6/0x6a0 [ 101.721110][ T5324] filename_rmdir+0x292/0x520 [ 101.723356][ T5324] __se_sys_rmdir+0x2e/0x140 [ 101.725489][ T5324] do_syscall_64+0x166/0x520 [ 101.727665][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.730310][ T5324] [ 101.730310][ T5324] -> #0 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}: [ 101.733906][ T5324] __lock_acquire+0x164c/0x2de0 [ 101.736111][ T5324] lock_acquire+0x115/0x350 [ 101.738254][ T5324] down_write+0x96/0x200 [ 101.740164][ T5324] configfs_depend_item_unlocked+0x153/0x420 [ 101.742861][ T5324] usbg_make_tpg+0x1e0/0x550 [ 101.745003][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 101.747542][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 101.749818][ T5324] vfs_mkdir+0x40c/0x620 [ 101.751824][ T5324] filename_mkdirat+0x285/0x510 [ 101.754051][ T5324] __se_sys_mkdir+0x34/0x150 [ 101.756245][ T5324] do_syscall_64+0x166/0x520 [ 101.758442][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.761184][ T5324] [ 101.761184][ T5324] other info that might help us debug this: [ 101.761184][ T5324] [ 101.765422][ T5324] Chain exists of: [ 101.765422][ T5324] &sb->s_type->i_mutex_key#25 --> func_lock --> tpg_instances_lock [ 101.765422][ T5324] [ 101.770977][ T5324] Possible unsafe locking scenario: [ 101.770977][ T5324] [ 101.774186][ T5324] CPU0 CPU1 [ 101.776534][ T5324] ---- ---- [ 101.778726][ T5324] lock(tpg_instances_lock); [ 101.780734][ T5324] lock(func_lock); [ 101.783381][ T5324] lock(tpg_instances_lock); [ 101.786333][ T5324] lock(&sb->s_type->i_mutex_key#25); [ 101.788627][ T5324] [ 101.788627][ T5324] *** DEADLOCK *** [ 101.788627][ T5324] [ 101.791850][ T5324] locks held by syz.0.0/5324: 4, last CPU#0: [ 101.794078][ T5324] #0: ffff88803304a460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 101.797965][ T5324] #1: ffff88801416a740 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 101.802195][ T5324] #2: ffffffff9093e808 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 101.806036][ T5324] #3: ffffffff90c740c0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 101.809562][ T5324] [ 101.809562][ T5324] stack backtrace: [ 101.811909][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.814859][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.821326][ T5324] Call Trace: [ 101.822842][ T5324] [ 101.824101][ T5324] dump_stack_lvl+0xe8/0x150 [ 101.825922][ T5324] print_circular_bug+0x2e2/0x300 [ 101.827903][ T5324] check_noncircular+0x12f/0x150 [ 101.829887][ T5324] __lock_acquire+0x164c/0x2de0 [ 101.831765][ T5324] ? __mutex_trylock_common+0x15f/0x270 [ 101.833786][ T5324] ? __pfx___mutex_trylock_common+0x10/0x10 [ 101.835913][ T5324] ? rcu_is_watching+0x16/0xb0 [ 101.837729][ T5324] lock_acquire+0x115/0x350 [ 101.839575][ T5324] ? configfs_depend_item_unlocked+0x153/0x420 [ 101.842105][ T5324] down_write+0x96/0x200 [ 101.843763][ T5324] ? configfs_depend_item_unlocked+0x153/0x420 [ 101.846197][ T5324] ? __pfx_down_write+0x10/0x10 [ 101.848042][ T5324] ? kstrtoull+0x137/0x1d0 [ 101.849734][ T5324] configfs_depend_item_unlocked+0x153/0x420 [ 101.852057][ T5324] usbg_make_tpg+0x1e0/0x550 [ 101.854041][ T5324] ? configfs_mkdir+0x4b0/0x9e0 [ 101.856120][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 101.858183][ T5324] ? __pfx_usbg_make_tpg+0x10/0x10 [ 101.860051][ T5324] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.864740][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 101.867037][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 101.869131][ T5324] ? d_splice_alias+0x12/0x30 [ 101.871187][ T5324] ? __pfx_configfs_mkdir+0x10/0x10 [ 101.873493][ T5324] ? generic_permission+0x2bf/0x670 [ 101.875769][ T5324] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 101.878021][ T5324] vfs_mkdir+0x40c/0x620 [ 101.879800][ T5324] filename_mkdirat+0x285/0x510 [ 101.881620][ T5324] ? __pfx_filename_mkdirat+0x10/0x10 [ 101.883536][ T5324] ? do_getname+0x151/0x250 [ 101.885149][ T5324] __se_sys_mkdir+0x34/0x150 [ 101.886858][ T5324] do_syscall_64+0x166/0x520 [ 101.888691][ T5324] ? trace_irq_disable+0x3b/0x140 [ 101.890701][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.893332][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 101.895459][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.897902][ T5324] RIP: 0033:0x7f776799e1d9 [ 101.899916][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.906998][ T5324] RSP: 002b:00007f77687f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 101.910672][ T5324] RAX: ffffffffffffffda RBX: 00007f7767c26180 RCX: 00007f776799e1d9 [ 101.914102][ T5324] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000240 [ 101.917550][ T5324] RBP: 00007f7767a35888 R08: 0000000000000000 R09: 0000000000000000 [ 101.920984][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.924449][ T5324] R13: 00007f7767c26218 R14: 00007f7767c26180 R15: 00007fff94a93f88 [ 101.927953][ T5324] [ 101.969372][ T5320] block nbd0: shutting down sockets