program: mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) (async) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) chdir(&(0x7f0000000000)='./config/usb_gadget/g1\x00') (async) chdir(&(0x7f0000000000)='./config/usb_gadget/g1\x00') setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) fstat(r0, &(0x7f0000000100)) (async) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000280)='./config\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) socket$unix(0x1, 0x2, 0x0) (async) r3 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0}, &(0x7f0000000400)=0xc) setresuid(0x0, r4, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) (async) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) read$FUSE(r5, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r5, &(0x7f00000024c0)={0x130, 0x0, r6, {0x4000000000007, 0xc, 0x0, '\x00', {0x6, 0xaf22, 0x1, 0x6, 0x0, r7, 0xa000, '\x00', 0x401, 0x8, 0xd60b, 0x800000000000073b, {0x4002008, 0xfffffff0}, {0x203d7c, 0x2, 0xc000000}, {0x10000000040c, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) lsetxattr$system_posix_acl(&(0x7f0000000080)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', &(0x7f00000000c0)='system.posix_acl_default\x00', &(0x7f0000002600)={{}, {0x1, 0x4}, [{0x2, 0x6, r1}, {0x2, 0x3, r2}, {0x2, 0x4, r4}], {0x4, 0x3}, [{0x8, 0x3, r7}], {0x10, 0x1}, {0x20, 0x2}}, 0x44, 0x3) write(r0, &(0x7f00000003c0)='fi', 0x2) [ 96.671109][ T5300] Bluetooth: hci0: command tx timeout [ 96.904058][ T5345] LUN: removable file: (no medium) [ 96.937141][ T5344] [ 96.938264][ T5344] ============================================ [ 96.940998][ T5344] WARNING: possible recursive locking detected [ 96.943795][ T5344] syzkaller #0 Not tainted [ 96.945832][ T5344] -------------------------------------------- [ 96.948650][ T5344] syz.0.0/5344 is trying to acquire lock: [ 96.951525][ T5344] ffff8880333d2478 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 96.955314][ T5344] [ 96.955314][ T5344] but task is already holding lock: [ 96.958396][ T5344] ffff8880333d2478 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 96.961842][ T5344] [ 96.961842][ T5344] other info that might help us debug this: [ 96.965110][ T5344] Possible unsafe locking scenario: [ 96.965110][ T5344] [ 96.968157][ T5344] CPU0 [ 96.969795][ T5344] ---- [ 96.971321][ T5344] lock(sb_writers#12); [ 96.973108][ T5344] lock(sb_writers#12); [ 96.974936][ T5344] [ 96.974936][ T5344] *** DEADLOCK *** [ 96.974936][ T5344] [ 96.978348][ T5344] May be due to missing lock nesting notation [ 96.978348][ T5344] [ 96.981891][ T5344] locks held by syz.0.0/5344: 5, on CPU#0: [ 96.984403][ T5344] #0: ffff8880147357f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 96.988102][ T5344] #1: ffff8880333d2478 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 96.991633][ T5344] #2: ffff888054333c80 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x7e/0x430 [ 96.995347][ T5344] #3: ffff888038eeba70 (&p->frag_sem){.+.+}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 96.999296][ T5344] #4: ffff888014b9e120 (&common->filesem){+.+.}-{4:4}, at: fsg_store_file+0x163/0x400 [ 97.003426][ T5344] [ 97.003426][ T5344] stack backtrace: [ 97.005823][ T5344] CPU: 0 UID: 0 PID: 5344 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 97.009633][ T5344] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.014064][ T5344] Call Trace: [ 97.015588][ T5344] [ 97.016808][ T5344] dump_stack_lvl+0xe8/0x150 [ 97.018655][ T5344] print_deadlock_bug+0x27a/0x290 [ 97.020784][ T5344] __lock_acquire+0x25db/0x2de0 [ 97.022826][ T5344] lock_acquire+0x115/0x350 [ 97.024671][ T5344] ? mnt_want_write+0x41/0x90 [ 97.026533][ T5344] sb_start_write+0x48/0x1c0 [ 97.028434][ T5344] ? mnt_want_write+0x41/0x90 [ 97.030308][ T5344] mnt_want_write+0x41/0x90 [ 97.032058][ T5344] lookup_open+0x1f7/0x1ae0 [ 97.033817][ T5344] path_openat+0x70c/0x20f0 [ 97.035644][ T5344] do_file_open+0x23e/0x4a0 [ 97.037677][ T5344] ? __pfx_do_file_open+0x10/0x10 [ 97.039820][ T5344] ? do_getname_kernel+0x54/0x230 [ 97.041866][ T5344] ? do_getname_kernel+0x97/0x230 [ 97.043998][ T5344] ? __asan_memcpy+0x40/0x70 [ 97.045876][ T5344] filp_open+0x16d/0x1d0 [ 97.047695][ T5344] ? __pfx_filp_open+0x10/0x10 [ 97.049655][ T5344] ? lock_acquire+0x232/0x350 [ 97.051484][ T5344] fsg_lun_open+0x6c/0xdf0 [ 97.053316][ T5344] fsg_store_file+0x19e/0x400 [ 97.055267][ T5344] ? __pfx_fsg_lun_opts_file_store+0x10/0x10 [ 97.057562][ T5344] configfs_write_iter+0x337/0x430 [ 97.059645][ T5344] vfs_write+0x612/0xba0 [ 97.061274][ T5344] ? __pfx_vfs_write+0x10/0x10 [ 97.063180][ T5344] ? __fget_files+0x3a2/0x420 [ 97.065124][ T5344] ? __fget_files+0x2a/0x420 [ 97.066994][ T5344] ? fdget+0x1ac/0x250 [ 97.068677][ T5344] ksys_write+0x150/0x270 [ 97.070472][ T5344] ? __pfx_ksys_write+0x10/0x10 [ 97.072327][ T5344] do_syscall_64+0x16a/0x530 [ 97.074222][ T5344] ? trace_irq_disable+0x3b/0x140 [ 97.076336][ T5344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.078827][ T5344] ? clear_bhb_loop+0x70/0xc0 [ 97.080708][ T5344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.083127][ T5344] RIP: 0033:0x7fafc31a8f19 [ 97.085009][ T5344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.093122][ T5344] RSP: 002b:00007fafc40bbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.096660][ T5344] RAX: ffffffffffffffda RBX: 00007fafc3425fa0 RCX: 00007fafc31a8f19 [ 97.100020][ T5344] RDX: 0000000000000002 RSI: 00002000000003c0 RDI: 0000000000000003 [ 97.103349][ T5344] RBP: 00007fafc3237f6d R08: 0000000000000000 R09: 0000000000000000 [ 97.106513][ T5344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.109944][ T5344] R13: 00007fafc3426038 R14: 00007fafc3425fa0 R15: 00007ffe122a0f08 [ 97.113111][ T5344] [ 97.124727][ T5344] mass_storage.0/lun.0: unable to open backing file: fi