program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='rd_pages=1024\n\x00', 0xf) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/dev0/enable\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n\x00', 0x3) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000000440)='naa.6001405123456780\n\x00', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='1\n\x00', 0x3) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000600)='dummy_udc.0\n\x00', 0xd) close(r4) nanosleep(&(0x7f0000000640)={0x1}, 0x0) syz_open_dev$sg(&(0x7f0000000680), 0x0, 0x2) r5 = syz_open_dev$sg(&(0x7f0000000680), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000680), 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./payload\x00', 0x42, 0x1ff) write(r6, &(0x7f0000001000)="000000000000000011223344556677880000000000000000", 0x18) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000800)={0x0, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x18, &(0x7f0000001000)=""/24}, &(0x7f0000002000)="5f000000000000001800", &(0x7f0000003000)=""/32, 0x1388, 0x0, 0x0, 0x0}) [ 101.383737][ T5280] Bluetooth: hci0: command tx timeout [ 101.676873][ T5318] [ 101.678076][ T5318] ====================================================== [ 101.681115][ T5318] WARNING: possible circular locking dependency detected [ 101.684108][ T5318] syzkaller #0 Not tainted [ 101.686107][ T5318] ------------------------------------------------------ [ 101.689102][ T5318] syz.0.0/5318 is trying to acquire lock: [ 101.691547][ T5318] ffff88801d087a40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 101.696545][ T5318] [ 101.696545][ T5318] but task is already holding lock: [ 101.699688][ T5318] ffffffff8fc72ac0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 101.703905][ T5318] [ 101.703905][ T5318] which lock already depends on the new lock. [ 101.703905][ T5318] [ 101.708479][ T5318] [ 101.708479][ T5318] the existing dependency chain (in reverse order) is: [ 101.712330][ T5318] [ 101.712330][ T5318] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 101.715886][ T5318] __mutex_lock+0x19d/0x1550 [ 101.718236][ T5318] tcm_alloc+0x21/0x2e0 [ 101.720425][ T5318] usb_get_function+0x63/0xb0 [ 101.722847][ T5318] config_usb_cfg_link+0x148/0x260 [ 101.725529][ T5318] configfs_symlink+0x74e/0x11d0 [ 101.728017][ T5318] vfs_symlink+0x18b/0x330 [ 101.730288][ T5318] filename_symlinkat+0x1cd/0x410 [ 101.732836][ T5318] __se_sys_symlinkat+0x4e/0x2b0 [ 101.735311][ T5318] do_syscall_64+0x166/0x520 [ 101.737658][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.740589][ T5318] [ 101.740589][ T5318] -> #1 (&gi->lock){+.+.}-{4:4}: [ 101.743769][ T5318] __mutex_lock+0x19d/0x1550 [ 101.746259][ T5318] config_usb_cfg_link+0x59/0x260 [ 101.748724][ T5318] configfs_symlink+0x74e/0x11d0 [ 101.751186][ T5318] vfs_symlink+0x18b/0x330 [ 101.753398][ T5318] filename_symlinkat+0x1cd/0x410 [ 101.755887][ T5318] __se_sys_symlinkat+0x4e/0x2b0 [ 101.758269][ T5318] do_syscall_64+0x166/0x520 [ 101.760551][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.763541][ T5318] [ 101.763541][ T5318] -> #0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 101.767396][ T5318] __lock_acquire+0x164c/0x2de0 [ 101.769877][ T5318] lock_acquire+0x115/0x350 [ 101.772072][ T5318] down_write+0x96/0x200 [ 101.774341][ T5318] configfs_depend_item_unlocked+0x153/0x420 [ 101.777189][ T5318] usbg_make_tpg+0x1e0/0x550 [ 101.779416][ T5318] target_fabric_make_tpg+0xa8/0x6d0 [ 101.782049][ T5318] configfs_mkdir+0x4f6/0x9e0 [ 101.784350][ T5318] vfs_mkdir+0x40c/0x620 [ 101.786475][ T5318] filename_mkdirat+0x285/0x510 [ 101.788852][ T5318] __se_sys_mkdirat+0x35/0x150 [ 101.791207][ T5318] do_syscall_64+0x166/0x520 [ 101.793505][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.796435][ T5318] [ 101.796435][ T5318] other info that might help us debug this: [ 101.796435][ T5318] [ 101.800767][ T5318] Chain exists of: [ 101.800767][ T5318] &sb->s_type->i_mutex_key#24 --> &gi->lock --> tpg_instances_lock [ 101.800767][ T5318] [ 101.806715][ T5318] Possible unsafe locking scenario: [ 101.806715][ T5318] [ 101.809941][ T5318] CPU0 CPU1 [ 101.812257][ T5318] ---- ---- [ 101.814645][ T5318] lock(tpg_instances_lock); [ 101.816831][ T5318] lock(&gi->lock); [ 101.819800][ T5318] lock(tpg_instances_lock); [ 101.823024][ T5318] lock(&sb->s_type->i_mutex_key#24); [ 101.825638][ T5318] [ 101.825638][ T5318] *** DEADLOCK *** [ 101.825638][ T5318] [ 101.829130][ T5318] locks held by syz.0.0/5318: 4, last CPU#0: [ 101.831732][ T5318] #0: ffff888000f38460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 101.835636][ T5318] #1: ffff88801fd7c140 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 101.840235][ T5318] #2: ffffffff8f93d288 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 101.844606][ T5318] #3: ffffffff8fc72ac0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 101.849002][ T5318] [ 101.849002][ T5318] stack backtrace: [ 101.851600][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.855494][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.859753][ T5318] Call Trace: [ 101.861215][ T5318] [ 101.862531][ T5318] dump_stack_lvl+0xe8/0x150 [ 101.864614][ T5318] print_circular_bug+0x2e2/0x300 [ 101.866784][ T5318] check_noncircular+0x12f/0x150 [ 101.868890][ T5318] __lock_acquire+0x164c/0x2de0 [ 101.870985][ T5318] ? __mutex_trylock_common+0x15f/0x270 [ 101.873404][ T5318] ? __pfx___mutex_trylock_common+0x10/0x10 [ 101.876217][ T5318] ? rcu_is_watching+0x16/0xb0 [ 101.878347][ T5318] lock_acquire+0x115/0x350 [ 101.880302][ T5318] ? configfs_depend_item_unlocked+0x153/0x420 [ 101.882990][ T5318] down_write+0x96/0x200 [ 101.884849][ T5318] ? configfs_depend_item_unlocked+0x153/0x420 [ 101.887547][ T5318] ? __pfx_down_write+0x10/0x10 [ 101.889655][ T5318] ? kstrtoull+0x137/0x1d0 [ 101.891538][ T5318] configfs_depend_item_unlocked+0x153/0x420 [ 101.894204][ T5318] usbg_make_tpg+0x1e0/0x550 [ 101.896230][ T5318] ? configfs_mkdir+0x4b0/0x9e0 [ 101.898396][ T5318] ? __pfx___mutex_lock+0x10/0x10 [ 101.900641][ T5318] ? __pfx_usbg_make_tpg+0x10/0x10 [ 101.902890][ T5318] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.905103][ T5318] target_fabric_make_tpg+0xa8/0x6d0 [ 101.907385][ T5318] configfs_mkdir+0x4f6/0x9e0 [ 101.909400][ T5318] ? d_splice_alias+0x12/0x30 [ 101.911418][ T5318] ? __pfx_configfs_mkdir+0x10/0x10 [ 101.913654][ T5318] ? generic_permission+0x2bf/0x670 [ 101.915922][ T5318] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 101.918117][ T5318] vfs_mkdir+0x40c/0x620 [ 101.919938][ T5318] filename_mkdirat+0x285/0x510 [ 101.922034][ T5318] ? __pfx_filename_mkdirat+0x10/0x10 [ 101.924368][ T5318] ? do_getname+0x151/0x250 [ 101.926347][ T5318] __se_sys_mkdirat+0x35/0x150 [ 101.928452][ T5318] do_syscall_64+0x166/0x520 [ 101.930459][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.933287][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 101.935509][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.938158][ T5318] RIP: 0033:0x7f288479e159 [ 101.940093][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.948373][ T5318] RSP: 002b:00007f288568efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 101.952067][ T5318] RAX: ffffffffffffffda RBX: 00007f2884a25fa0 RCX: 00007f288479e159 [ 101.955590][ T5318] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 101.959205][ T5318] RBP: 00007f288483506b R08: 0000000000000000 R09: 0000000000000000 [ 101.962726][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.966236][ T5318] R13: 00007f2884a26038 R14: 00007f2884a25fa0 R15: 00007ffcd315e8b8 [ 101.969700][ T5318]