program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000840)='./config/target/core/rd_mcp_0/rd1\x00', &(0x7f0000000880)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/rd1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000940)='naa.6001405123456789\x00', 0x14) r5 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r5, &(0x7f00000009c0)='1\x00', 0x1) symlink(&(0x7f0000000a00)='./config/usb_gadget/g1/functions/tcm.0\x00', &(0x7f0000000a40)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000000ac0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r7 = syz_open_dev$sg(&(0x7f0000000b00), 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f0000000200)=""/28}, &(0x7f0000000300)="5f000000000000001c00", &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0}) [ 98.689436][ T44] Bluetooth: hci0: command tx timeout [ 98.779689][ T24] audit: type=1800 audit(1785849348.026:2): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4260 res=0 errno=0 [ 98.797355][ T24] audit: type=1800 audit(1785849348.046:3): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idVendor" dev="configfs" ino=4267 res=0 errno=0 [ 98.819575][ T24] audit: type=1800 audit(1785849348.046:4): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idProduct" dev="configfs" ino=4268 res=0 errno=0 [ 98.829754][ T5332] se_device not configured yet, cannot port link [ 98.835571][ T24] audit: type=1800 audit(1785849348.086:5): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="nexus" dev="configfs" ino=4289 res=0 errno=0 [ 98.844991][ T5332] [ 98.845945][ T5332] ====================================================== [ 98.848448][ T5332] WARNING: possible circular locking dependency detected [ 98.851008][ T5332] syzkaller #0 Not tainted [ 98.852614][ T5332] ------------------------------------------------------ [ 98.855166][ T5332] syz.0.0/5332 is trying to acquire lock: [ 98.857163][ T5332] ffffffff8fa50d80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 98.860424][ T5332] [ 98.860424][ T5332] but task is already holding lock: [ 98.862919][ T5332] ffff888012fc6390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 98.866372][ T5332] [ 98.866372][ T5332] which lock already depends on the new lock. [ 98.866372][ T5332] [ 98.870280][ T5332] [ 98.870280][ T5332] the existing dependency chain (in reverse order) is: [ 98.873683][ T5332] [ 98.873683][ T5332] -> #3 (&gi->lock){+.+.}-{4:4}: [ 98.876652][ T5332] __mutex_lock+0x19d/0x1550 [ 98.878712][ T5332] config_usb_cfg_link+0x59/0x260 [ 98.881014][ T5332] configfs_symlink+0x59a/0x1030 [ 98.883251][ T5332] vfs_symlink+0x18b/0x330 [ 98.885262][ T5332] filename_symlinkat+0x1cd/0x410 [ 98.887451][ T5332] __se_sys_symlink+0x4d/0x2b0 [ 98.889576][ T5332] do_syscall_64+0x174/0x580 [ 98.891596][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.894210][ T5332] [ 98.894210][ T5332] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 98.897759][ T5332] down_write+0x96/0x200 [ 98.899739][ T5332] configfs_depend_item_unlocked+0x153/0x420 [ 98.902411][ T5332] usbg_make_tpg+0x1f6/0x590 [ 98.904537][ T5332] target_fabric_make_tpg+0xa8/0x6d0 [ 98.907043][ T5332] configfs_mkdir+0x4f6/0x9e0 [ 98.909261][ T5332] vfs_mkdir+0x406/0x620 [ 98.911278][ T5332] filename_mkdirat+0x285/0x510 [ 98.913491][ T5332] __se_sys_mkdirat+0x35/0x150 [ 98.915716][ T5332] do_syscall_64+0x174/0x580 [ 98.917904][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.920621][ T5332] [ 98.920621][ T5332] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 98.923872][ T5332] __mutex_lock+0x19d/0x1550 [ 98.926132][ T5332] usbg_make_tpg+0x147/0x590 [ 98.928385][ T5332] target_fabric_make_tpg+0xa8/0x6d0 [ 98.930947][ T5332] configfs_mkdir+0x4f6/0x9e0 [ 98.933192][ T5332] vfs_mkdir+0x406/0x620 [ 98.935277][ T5332] filename_mkdirat+0x285/0x510 [ 98.937605][ T5332] __se_sys_mkdirat+0x35/0x150 [ 98.939944][ T5332] do_syscall_64+0x174/0x580 [ 98.942123][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.944737][ T5332] [ 98.944737][ T5332] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 98.947559][ T5332] __lock_acquire+0x1520/0x2cf0 [ 98.949321][ T5332] lock_acquire+0x106/0x350 [ 98.951001][ T5332] __mutex_lock+0x19d/0x1550 [ 98.952656][ T5332] tcm_alloc+0x21/0x2e0 [ 98.954191][ T5332] usb_get_function+0x63/0xb0 [ 98.955929][ T5332] config_usb_cfg_link+0x148/0x260 [ 98.957792][ T5332] configfs_symlink+0x59a/0x1030 [ 98.959575][ T5332] vfs_symlink+0x18b/0x330 [ 98.961190][ T5332] filename_symlinkat+0x1cd/0x410 [ 98.962970][ T5332] __se_sys_symlink+0x4d/0x2b0 [ 98.964655][ T5332] do_syscall_64+0x174/0x580 [ 98.966391][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.968510][ T5332] [ 98.968510][ T5332] other info that might help us debug this: [ 98.968510][ T5332] [ 98.971750][ T5332] Chain exists of: [ 98.971750][ T5332] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 98.971750][ T5332] [ 98.976202][ T5332] Possible unsafe locking scenario: [ 98.976202][ T5332] [ 98.978642][ T5332] CPU0 CPU1 [ 98.980458][ T5332] ---- ---- [ 98.982230][ T5332] lock(&gi->lock); [ 98.983521][ T5332] lock(&sb->s_type->i_mutex_key#24); [ 98.986065][ T5332] lock(&gi->lock); [ 98.988087][ T5332] lock(tpg_instances_lock); [ 98.989588][ T5332] [ 98.989588][ T5332] *** DEADLOCK *** [ 98.989588][ T5332] [ 98.992214][ T5332] 3 locks held by syz.0.0/5332: [ 98.993836][ T5332] #0: ffff888000bae450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 98.997489][ T5332] #1: ffff888013196c00 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 99.002125][ T5332] #2: ffff888012fc6390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 99.006067][ T5332] [ 99.006067][ T5332] stack backtrace: [ 99.008538][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 99.008555][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.008563][ T5332] Call Trace: [ 99.008570][ T5332] [ 99.008576][ T5332] dump_stack_lvl+0xe8/0x150 [ 99.008598][ T5332] print_circular_bug+0x2e1/0x300 [ 99.008613][ T5332] check_noncircular+0x12e/0x150 [ 99.008640][ T5332] __lock_acquire+0x1520/0x2cf0 [ 99.008660][ T5332] ? __lock_acquire+0x13e8/0x2cf0 [ 99.008678][ T5332] ? __pfx_stack_trace_save+0x10/0x10 [ 99.008696][ T5332] ? tcm_alloc+0x21/0x2e0 [ 99.008711][ T5332] lock_acquire+0x106/0x350 [ 99.008728][ T5332] ? tcm_alloc+0x21/0x2e0 [ 99.008744][ T5332] __mutex_lock+0x19d/0x1550 [ 99.008760][ T5332] ? tcm_alloc+0x21/0x2e0 [ 99.008773][ T5332] ? trace_contention_end+0x3d/0x140 [ 99.008786][ T5332] ? __mutex_lock+0x30d/0x1550 [ 99.008798][ T5332] ? tcm_alloc+0x21/0x2e0 [ 99.008812][ T5332] ? __pfx___mutex_lock+0x10/0x10 [ 99.008827][ T5332] ? __pfx___mutex_lock+0x10/0x10 [ 99.008840][ T5332] tcm_alloc+0x21/0x2e0 [ 99.008853][ T5332] usb_get_function+0x63/0xb0 [ 99.008866][ T5332] config_usb_cfg_link+0x148/0x260 [ 99.008882][ T5332] configfs_symlink+0x59a/0x1030 [ 99.008894][ T5332] ? lookup_one_qstr_excl+0x1d4/0x360 [ 99.008911][ T5332] ? make_vfsuid+0x49/0xa0 [ 99.008923][ T5332] ? __pfx_configfs_symlink+0x10/0x10 [ 99.008935][ T5332] ? bpf_lsm_inode_symlink+0x9/0x20 [ 99.008957][ T5332] vfs_symlink+0x18b/0x330 [ 99.008968][ T5332] ? security_path_symlink+0xfd/0x360 [ 99.008981][ T5332] filename_symlinkat+0x1cd/0x410 [ 99.008995][ T5332] ? __pfx_filename_symlinkat+0x10/0x10 [ 99.009008][ T5332] ? do_getname+0x151/0x250 [ 99.009019][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.009031][ T5332] __se_sys_symlink+0x4d/0x2b0 [ 99.009042][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.009053][ T5332] do_syscall_64+0x174/0x580 [ 99.009068][ T5332] ? trace_irq_disable+0x3b/0x140 [ 99.009082][ T5332] ? clear_bhb_loop+0x40/0x90 [ 99.009093][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.009105][ T5332] RIP: 0033:0x7fcfb0d9e019 [ 99.009117][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.009127][ T5332] RSP: 002b:00007fcfb1b84fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 99.009141][ T5332] RAX: ffffffffffffffda RBX: 00007fcfb1025fa0 RCX: 00007fcfb0d9e019 [ 99.009150][ T5332] RDX: 0000000000000000 RSI: 0000200000000a40 RDI: 0000200000000a00 [ 99.009157][ T5332] RBP: 00007fcfb0e3500c R08: 0000000000000000 R09: 0000000000000000 [ 99.009164][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.009172][ T5332] R13: 00007fcfb1026038 R14: 00007fcfb1025fa0 R15: 00007ffd3a400628 [ 99.009185][ T5332] [ 99.117156][ T24] audit: type=1800 audit(1785849348.096:6): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4290 res=0 errno=0 [ 99.134075][ T24] audit: type=1800 audit(1785849348.386:7): pid=5332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4292 res=0 errno=0 [ 99.379131][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 99.529873][ T9] usb 5-1: Dual-Role OTG device on HNP port [ 99.532476][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02 [ 99.535695][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.541993][ T5330] Using the BOT protocol [ 99.548733][ T10] Using the UAS protocol [ 99.560744][ T9] scsi host6: uas qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x126000)