program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000140)='./config/target/core/rd_mcp_0/rd1\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/rd1\x00') symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000700)='naa.6001405123456789\x00', 0x14) r5 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r5, &(0x7f0000000780)='1\x00', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000000800)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000840)={0x1}, 0x0) r7 = syz_open_dev$sg(0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000008c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', 0x1c) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000880)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f00000008c0)=""/28}, &(0x7f0000000900)="5f000000000000001c00", &(0x7f0000000940), 0x0, 0x0, 0x0, 0x0}) [ 85.460393][ T24] audit: type=1800 audit(1785849942.389:2): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4253 res=0 errno=0 [ 85.481170][ T24] audit: type=1800 audit(1785849942.399:3): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idVendor" dev="configfs" ino=4260 res=0 errno=0 [ 85.492232][ T5330] se_device not configured yet, cannot port link [ 85.495105][ T5330] [ 85.495979][ T5330] ====================================================== [ 85.498319][ T5330] WARNING: possible circular locking dependency detected [ 85.500614][ T5330] syzkaller #0 Not tainted [ 85.502122][ T5330] ------------------------------------------------------ [ 85.504536][ T5330] syz.0.0/5330 is trying to acquire lock: [ 85.506462][ T5330] ffffffff8fa50d80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 85.509442][ T5330] [ 85.509442][ T5330] but task is already holding lock: [ 85.511786][ T5330] ffff888038bdc390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.514729][ T5330] [ 85.514729][ T5330] which lock already depends on the new lock. [ 85.514729][ T5330] [ 85.518256][ T5330] [ 85.518256][ T5330] the existing dependency chain (in reverse order) is: [ 85.521707][ T5330] [ 85.521707][ T5330] -> #3 (&gi->lock){+.+.}-{4:4}: [ 85.524578][ T5330] __mutex_lock+0x19d/0x1550 [ 85.526269][ T5330] config_usb_cfg_link+0x59/0x260 [ 85.528066][ T5330] configfs_symlink+0x59a/0x1030 [ 85.529802][ T5330] vfs_symlink+0x18b/0x330 [ 85.531377][ T5330] filename_symlinkat+0x1cd/0x410 [ 85.533136][ T5330] __se_sys_symlinkat+0x4e/0x2b0 [ 85.534887][ T5330] do_syscall_64+0x174/0x580 [ 85.536501][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.538509][ T5330] [ 85.538509][ T5330] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 85.541444][ T5330] down_write+0x96/0x200 [ 85.543232][ T5330] configfs_depend_item_unlocked+0x153/0x420 [ 85.545573][ T5330] usbg_make_tpg+0x1f6/0x590 [ 85.547251][ T5330] target_fabric_make_tpg+0xa8/0x6d0 [ 85.549156][ T5330] configfs_mkdir+0x4f6/0x9e0 [ 85.550863][ T5330] vfs_mkdir+0x406/0x620 [ 85.552447][ T5330] filename_mkdirat+0x285/0x510 [ 85.554213][ T5330] __se_sys_mkdirat+0x35/0x150 [ 85.555908][ T5330] do_syscall_64+0x174/0x580 [ 85.557545][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.559546][ T5330] [ 85.559546][ T5330] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 85.562044][ T5330] __mutex_lock+0x19d/0x1550 [ 85.563722][ T5330] usbg_make_tpg+0x147/0x590 [ 85.565399][ T5330] target_fabric_make_tpg+0xa8/0x6d0 [ 85.567268][ T5330] configfs_mkdir+0x4f6/0x9e0 [ 85.568980][ T5330] vfs_mkdir+0x406/0x620 [ 85.570518][ T5330] filename_mkdirat+0x285/0x510 [ 85.572257][ T5330] __se_sys_mkdirat+0x35/0x150 [ 85.573970][ T5330] do_syscall_64+0x174/0x580 [ 85.575637][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.577770][ T5330] [ 85.577770][ T5330] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 85.580292][ T5330] __lock_acquire+0x1520/0x2cf0 [ 85.581996][ T5330] lock_acquire+0x106/0x350 [ 85.583716][ T5330] __mutex_lock+0x19d/0x1550 [ 85.585386][ T5330] tcm_alloc+0x21/0x2e0 [ 85.586914][ T5330] usb_get_function+0x63/0xb0 [ 85.588601][ T5330] config_usb_cfg_link+0x148/0x260 [ 85.590402][ T5330] configfs_symlink+0x59a/0x1030 [ 85.592192][ T5330] vfs_symlink+0x18b/0x330 [ 85.593796][ T5330] filename_symlinkat+0x1cd/0x410 [ 85.595589][ T5330] __se_sys_symlinkat+0x4e/0x2b0 [ 85.597356][ T5330] do_syscall_64+0x174/0x580 [ 85.599019][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.601097][ T5330] [ 85.601097][ T5330] other info that might help us debug this: [ 85.601097][ T5330] [ 85.604378][ T5330] Chain exists of: [ 85.604378][ T5330] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 85.604378][ T5330] [ 85.608773][ T5330] Possible unsafe locking scenario: [ 85.608773][ T5330] [ 85.611176][ T5330] CPU0 CPU1 [ 85.612935][ T5330] ---- ---- [ 85.614760][ T5330] lock(&gi->lock); [ 85.616047][ T5330] lock(&sb->s_type->i_mutex_key#24); [ 85.618619][ T5330] lock(&gi->lock); [ 85.620701][ T5330] lock(tpg_instances_lock); [ 85.622218][ T5330] [ 85.622218][ T5330] *** DEADLOCK *** [ 85.622218][ T5330] [ 85.624941][ T5330] 3 locks held by syz.0.0/5330: [ 85.626544][ T5330] #0: ffff888000370450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 85.629555][ T5330] #1: ffff888044160140 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 85.633158][ T5330] #2: ffff888038bdc390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.636420][ T5330] [ 85.636420][ T5330] stack backtrace: [ 85.638544][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.638555][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.638561][ T5330] Call Trace: [ 85.638566][ T5330] [ 85.638570][ T5330] dump_stack_lvl+0xe8/0x150 [ 85.638582][ T5330] print_circular_bug+0x2e1/0x300 [ 85.638592][ T5330] check_noncircular+0x12e/0x150 [ 85.638601][ T5330] __lock_acquire+0x1520/0x2cf0 [ 85.638613][ T5330] ? __lock_acquire+0x13e8/0x2cf0 [ 85.638624][ T5330] ? __pfx_stack_trace_save+0x10/0x10 [ 85.638635][ T5330] ? tcm_alloc+0x21/0x2e0 [ 85.638643][ T5330] lock_acquire+0x106/0x350 [ 85.638653][ T5330] ? tcm_alloc+0x21/0x2e0 [ 85.638662][ T5330] __mutex_lock+0x19d/0x1550 [ 85.638673][ T5330] ? tcm_alloc+0x21/0x2e0 [ 85.638685][ T5330] ? trace_contention_end+0x3d/0x140 [ 85.638696][ T5330] ? __mutex_lock+0x30d/0x1550 [ 85.638709][ T5330] ? tcm_alloc+0x21/0x2e0 [ 85.638721][ T5330] ? __pfx___mutex_lock+0x10/0x10 [ 85.638735][ T5330] ? __pfx___mutex_lock+0x10/0x10 [ 85.638751][ T5330] tcm_alloc+0x21/0x2e0 [ 85.638762][ T5330] usb_get_function+0x63/0xb0 [ 85.638770][ T5330] config_usb_cfg_link+0x148/0x260 [ 85.638779][ T5330] configfs_symlink+0x59a/0x1030 [ 85.638787][ T5330] ? lookup_one_qstr_excl+0x1d4/0x360 [ 85.638802][ T5330] ? make_vfsuid+0x49/0xa0 [ 85.638809][ T5330] ? __pfx_configfs_symlink+0x10/0x10 [ 85.638816][ T5330] ? bpf_lsm_inode_symlink+0x9/0x20 [ 85.638828][ T5330] vfs_symlink+0x18b/0x330 [ 85.638835][ T5330] ? security_path_symlink+0xfd/0x360 [ 85.638844][ T5330] filename_symlinkat+0x1cd/0x410 [ 85.638852][ T5330] ? __pfx_filename_symlinkat+0x10/0x10 [ 85.638860][ T5330] ? do_getname+0x151/0x250 [ 85.638869][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.638876][ T5330] __se_sys_symlinkat+0x4e/0x2b0 [ 85.638883][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.638890][ T5330] do_syscall_64+0x174/0x580 [ 85.638903][ T5330] ? trace_irq_disable+0x3b/0x140 [ 85.638916][ T5330] ? clear_bhb_loop+0x40/0x90 [ 85.638927][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.638939][ T5330] RIP: 0033:0x7f45b639e019 [ 85.638950][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.638959][ T5330] RSP: 002b:00007f45b7343fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 85.638971][ T5330] RAX: ffffffffffffffda RBX: 00007f45b6625fa0 RCX: 00007f45b639e019 [ 85.638978][ T5330] RDX: 0000200000000500 RSI: ffffffffffffff9c RDI: 0000200000000440 [ 85.638983][ T5330] RBP: 00007f45b643500c R08: 0000000000000000 R09: 0000000000000000 [ 85.638987][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.638992][ T5330] R13: 00007f45b6626038 R14: 00007f45b6625fa0 R15: 00007ffc9f33f7a8 [ 85.638999][ T5330] [ 85.747219][ T24] audit: type=1800 audit(1785849942.399:4): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idProduct" dev="configfs" ino=4261 res=0 errno=0 [ 85.756403][ T5294] Bluetooth: hci0: command tx timeout [ 85.769578][ T24] audit: type=1800 audit(1785849942.699:5): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="nexus" dev="configfs" ino=4282 res=0 errno=0 [ 85.778818][ T24] audit: type=1800 audit(1785849942.709:6): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4283 res=0 errno=0 [ 85.787775][ T24] audit: type=1800 audit(1785849942.719:7): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4284 res=0 errno=0 [ 86.027693][ T5318] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.178575][ T5318] usb 5-1: Dual-Role OTG device on HNP port [ 86.181383][ T5318] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02 [ 86.185179][ T5318] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.191535][ T9] Using the BOT protocol [ 86.205379][ T9] Using the UAS protocol [ 86.215327][ T5318] scsi host6: uas