program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16) write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5) unlinkat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x200) [ 104.321857][ T4644] Bluetooth: hci0: command tx timeout [ 104.512476][ T5320] [ 104.513609][ T5320] ====================================================== [ 104.516580][ T5320] WARNING: possible circular locking dependency detected [ 104.519489][ T5320] syzkaller #0 Not tainted [ 104.521471][ T5320] ------------------------------------------------------ [ 104.524329][ T5320] syz.0.0/5320 is trying to acquire lock: [ 104.526702][ T5320] ffffffff8f93dc28 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 104.530685][ T5320] [ 104.530685][ T5320] but task is already holding lock: [ 104.533786][ T5320] ffff88801f831dc0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 104.537674][ T5320] [ 104.537674][ T5320] which lock already depends on the new lock. [ 104.537674][ T5320] [ 104.541895][ T5320] [ 104.541895][ T5320] the existing dependency chain (in reverse order) is: [ 104.545718][ T5320] [ 104.545718][ T5320] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 104.549443][ T5320] down_write+0x96/0x200 [ 104.551730][ T5320] configfs_depend_item_unlocked+0x153/0x420 [ 104.554547][ T5320] usbg_make_tpg+0x1e0/0x550 [ 104.556797][ T5320] target_fabric_make_tpg+0xa8/0x6d0 [ 104.559374][ T5320] configfs_mkdir+0x4f6/0x9e0 [ 104.561546][ T5320] vfs_mkdir+0x40c/0x620 [ 104.563621][ T5320] filename_mkdirat+0x285/0x510 [ 104.565982][ T5320] __se_sys_mkdirat+0x35/0x150 [ 104.568253][ T5320] do_syscall_64+0x166/0x520 [ 104.570456][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.573278][ T5320] [ 104.573278][ T5320] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 104.576575][ T5320] __mutex_lock+0x19d/0x1550 [ 104.578702][ T5320] usbg_make_tpg+0xf8/0x550 [ 104.581053][ T5320] target_fabric_make_tpg+0xa8/0x6d0 [ 104.583574][ T5320] configfs_mkdir+0x4f6/0x9e0 [ 104.585804][ T5320] vfs_mkdir+0x40c/0x620 [ 104.587888][ T5320] filename_mkdirat+0x285/0x510 [ 104.590320][ T5320] __se_sys_mkdirat+0x35/0x150 [ 104.592697][ T5320] do_syscall_64+0x166/0x520 [ 104.594985][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.597826][ T5320] [ 104.597826][ T5320] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 104.601169][ T5320] __lock_acquire+0x164c/0x2de0 [ 104.603491][ T5320] lock_acquire+0x115/0x350 [ 104.605638][ T5320] __mutex_lock+0x19d/0x1550 [ 104.607903][ T5320] configfs_rmdir+0x5f0/0x950 [ 104.610115][ T5320] vfs_rmdir+0x3e6/0x6a0 [ 104.612282][ T5320] filename_rmdir+0x292/0x520 [ 104.614527][ T5320] __se_sys_unlinkat+0x71/0x1a0 [ 104.616777][ T5320] do_syscall_64+0x166/0x520 [ 104.618907][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.621618][ T5320] [ 104.621618][ T5320] other info that might help us debug this: [ 104.621618][ T5320] [ 104.625828][ T5320] Chain exists of: [ 104.625828][ T5320] &subsys->su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 104.625828][ T5320] [ 104.631789][ T5320] Possible unsafe locking scenario: [ 104.631789][ T5320] [ 104.635001][ T5320] CPU0 CPU1 [ 104.637302][ T5320] ---- ---- [ 104.639548][ T5320] lock(&sb->s_type->i_mutex_key#24); [ 104.641912][ T5320] lock(tpg_instances_lock); [ 104.645131][ T5320] lock(&sb->s_type->i_mutex_key#24); [ 104.648543][ T5320] lock(&subsys->su_mutex); [ 104.650534][ T5320] [ 104.650534][ T5320] *** DEADLOCK *** [ 104.650534][ T5320] [ 104.654003][ T5320] locks held by syz.0.0/5320: 3, last CPU#0: [ 104.656585][ T5320] #0: ffff888031334460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 104.660425][ T5320] #1: ffff8880373f0f80 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 [ 104.665010][ T5320] #2: ffff88801f831dc0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 104.669374][ T5320] [ 104.669374][ T5320] stack backtrace: [ 104.672165][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.676525][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.680970][ T5320] Call Trace: [ 104.682417][ T5320] [ 104.683814][ T5320] dump_stack_lvl+0xe8/0x150 [ 104.685887][ T5320] print_circular_bug+0x2e2/0x300 [ 104.688086][ T5320] check_noncircular+0x12f/0x150 [ 104.690229][ T5320] __lock_acquire+0x164c/0x2de0 [ 104.691999][ T5320] ? set_normalized_timespec64+0xf0/0x1a0 [ 104.694260][ T5320] ? __lock_acquire+0x747/0x2de0 [ 104.696282][ T5320] lock_acquire+0x115/0x350 [ 104.698183][ T5320] ? configfs_rmdir+0x5f0/0x950 [ 104.700308][ T5320] __mutex_lock+0x19d/0x1550 [ 104.702328][ T5320] ? configfs_rmdir+0x5f0/0x950 [ 104.704331][ T5320] ? reacquire_held_locks+0x117/0x1a0 [ 104.706432][ T5320] ? configfs_rmdir+0x5f0/0x950 [ 104.708358][ T5320] ? __pfx___mutex_lock+0x10/0x10 [ 104.710313][ T5320] ? _raw_spin_unlock+0x28/0x50 [ 104.712369][ T5320] ? fast_dput+0x481/0x690 [ 104.714325][ T5320] configfs_rmdir+0x5f0/0x950 [ 104.716358][ T5320] vfs_rmdir+0x3e6/0x6a0 [ 104.718034][ T5320] ? bpf_lsm_path_rmdir+0x9/0x20 [ 104.719969][ T5320] filename_rmdir+0x292/0x520 [ 104.722018][ T5320] ? __pfx_filename_rmdir+0x10/0x10 [ 104.724204][ T5320] ? do_getname+0x151/0x250 [ 104.726168][ T5320] __se_sys_unlinkat+0x71/0x1a0 [ 104.728297][ T5320] do_syscall_64+0x166/0x520 [ 104.730248][ T5320] ? trace_irq_disable+0x3b/0x140 [ 104.732503][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.735137][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 104.737248][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.739673][ T5320] RIP: 0033:0x7ff59d59e159 [ 104.741663][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.749554][ T5320] RSP: 002b:00007ff59e4dafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 104.753110][ T5320] RAX: ffffffffffffffda RBX: 00007ff59d825fa0 RCX: 00007ff59d59e159 [ 104.756498][ T5320] RDX: 0000000000000200 RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 104.759910][ T5320] RBP: 00007ff59d63506b R08: 0000000000000000 R09: 0000000000000000 [ 104.763350][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.766634][ T5320] R13: 00007ff59d826038 R14: 00007ff59d825fa0 R15: 00007ffcf9befca8 [ 104.770122][ T5320]