program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x200) [ 92.635183][ T4650] Bluetooth: hci0: command tx timeout [ 92.650379][ T1177] cfg80211: failed to load regulatory.db [ 92.771372][ T5324] [ 92.772443][ T5324] ====================================================== [ 92.775221][ T5324] WARNING: possible circular locking dependency detected [ 92.778007][ T5324] syzkaller #0 Not tainted [ 92.779779][ T5324] ------------------------------------------------------ [ 92.782683][ T5324] syz.0.0/5324 is trying to acquire lock: [ 92.785178][ T5324] ffffffff8f93dc28 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 92.789194][ T5324] [ 92.789194][ T5324] but task is already holding lock: [ 92.792379][ T5324] ffff88800bef9dc0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 92.796513][ T5324] [ 92.796513][ T5324] which lock already depends on the new lock. [ 92.796513][ T5324] [ 92.800970][ T5324] [ 92.800970][ T5324] the existing dependency chain (in reverse order) is: [ 92.804826][ T5324] [ 92.804826][ T5324] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 92.808540][ T5324] down_write+0x96/0x200 [ 92.810674][ T5324] configfs_depend_item_unlocked+0x153/0x420 [ 92.813458][ T5324] usbg_make_tpg+0x1e0/0x550 [ 92.815759][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 92.818252][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 92.820493][ T5324] vfs_mkdir+0x40c/0x620 [ 92.822446][ T5324] filename_mkdirat+0x285/0x510 [ 92.824767][ T5324] __se_sys_mkdirat+0x35/0x150 [ 92.827110][ T5324] do_syscall_64+0x166/0x520 [ 92.829421][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.832205][ T5324] [ 92.832205][ T5324] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 92.835412][ T5324] __mutex_lock+0x19d/0x1550 [ 92.837654][ T5324] usbg_make_tpg+0xf8/0x550 [ 92.839880][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 92.842411][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 92.844653][ T5324] vfs_mkdir+0x40c/0x620 [ 92.846815][ T5324] filename_mkdirat+0x285/0x510 [ 92.849174][ T5324] __se_sys_mkdirat+0x35/0x150 [ 92.851500][ T5324] do_syscall_64+0x166/0x520 [ 92.853707][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.856586][ T5324] [ 92.856586][ T5324] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 92.859919][ T5324] __lock_acquire+0x164c/0x2de0 [ 92.862331][ T5324] lock_acquire+0x115/0x350 [ 92.864633][ T5324] __mutex_lock+0x19d/0x1550 [ 92.866891][ T5324] configfs_rmdir+0x5f0/0x950 [ 92.869121][ T5324] vfs_rmdir+0x3e6/0x6a0 [ 92.871797][ T5324] filename_rmdir+0x292/0x520 [ 92.874414][ T5324] __se_sys_unlinkat+0x71/0x1a0 [ 92.876902][ T5324] do_syscall_64+0x166/0x520 [ 92.879469][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.882323][ T5324] [ 92.882323][ T5324] other info that might help us debug this: [ 92.882323][ T5324] [ 92.886804][ T5324] Chain exists of: [ 92.886804][ T5324] &subsys->su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 92.886804][ T5324] [ 92.893048][ T5324] Possible unsafe locking scenario: [ 92.893048][ T5324] [ 92.896240][ T5324] CPU0 CPU1 [ 92.898607][ T5324] ---- ---- [ 92.900984][ T5324] lock(&sb->s_type->i_mutex_key#24); [ 92.903386][ T5324] lock(tpg_instances_lock); [ 92.906488][ T5324] lock(&sb->s_type->i_mutex_key#24); [ 92.909973][ T5324] lock(&subsys->su_mutex); [ 92.912175][ T5324] [ 92.912175][ T5324] *** DEADLOCK *** [ 92.912175][ T5324] [ 92.915644][ T5324] locks held by syz.0.0/5324: 3, last CPU#0: [ 92.917937][ T5324] #0: ffff88803130a460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 92.921607][ T5324] #1: ffff88800befac00 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 [ 92.926131][ T5324] #2: ffff88800bef9dc0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 92.930275][ T5324] [ 92.930275][ T5324] stack backtrace: [ 92.932858][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.936388][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.940673][ T5324] Call Trace: [ 92.942071][ T5324] [ 92.943390][ T5324] dump_stack_lvl+0xe8/0x150 [ 92.945426][ T5324] print_circular_bug+0x2e2/0x300 [ 92.947610][ T5324] check_noncircular+0x12f/0x150 [ 92.949773][ T5324] __lock_acquire+0x164c/0x2de0 [ 92.951968][ T5324] ? set_normalized_timespec64+0xf0/0x1a0 [ 92.954558][ T5324] ? __lock_acquire+0x747/0x2de0 [ 92.956799][ T5324] lock_acquire+0x115/0x350 [ 92.958837][ T5324] ? configfs_rmdir+0x5f0/0x950 [ 92.961002][ T5324] __mutex_lock+0x19d/0x1550 [ 92.963039][ T5324] ? configfs_rmdir+0x5f0/0x950 [ 92.965192][ T5324] ? reacquire_held_locks+0x117/0x1a0 [ 92.967501][ T5324] ? configfs_rmdir+0x5f0/0x950 [ 92.969644][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 92.971888][ T5324] ? _raw_spin_unlock+0x28/0x50 [ 92.974044][ T5324] ? fast_dput+0x481/0x690 [ 92.975888][ T5324] configfs_rmdir+0x5f0/0x950 [ 92.977659][ T5324] vfs_rmdir+0x3e6/0x6a0 [ 92.979412][ T5324] ? bpf_lsm_path_rmdir+0x9/0x20 [ 92.981537][ T5324] filename_rmdir+0x292/0x520 [ 92.983607][ T5324] ? __pfx_filename_rmdir+0x10/0x10 [ 92.985851][ T5324] ? do_getname+0x151/0x250 [ 92.987850][ T5324] __se_sys_unlinkat+0x71/0x1a0 [ 92.989960][ T5324] do_syscall_64+0x166/0x520 [ 92.991959][ T5324] ? trace_irq_disable+0x3b/0x140 [ 92.994140][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.996755][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 92.998662][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.001022][ T5324] RIP: 0033:0x7f44ee79e199 [ 93.002816][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.011181][ T5324] RSP: 002b:00007f44ef72ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 93.014799][ T5324] RAX: ffffffffffffffda RBX: 00007f44eea25fa0 RCX: 00007f44ee79e199 [ 93.018267][ T5324] RDX: 0000000000000200 RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 93.021608][ T5324] RBP: 00007f44ee8350b8 R08: 0000000000000000 R09: 0000000000000000 [ 93.024804][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.028170][ T5324] R13: 00007f44eea26038 R14: 00007f44eea25fa0 R15: 00007ffd24c549a8 [ 93.031353][ T5324]