program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/ramdisk_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/ramdisk_0/rd\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/ramdisk_0/rd/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='rd_pages=32768\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/ramdisk_0/rd/enable\x00', 0x2, 0x0) write(r3, &(0x7f00000002c0)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000740)='./config/target/core/ramdisk_0/rd\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/port1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000800)='1\x00', 0x1) symlinkat(&(0x7f0000000840)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000900)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000940)={0x1}, 0x0) [ 94.917458][ T4652] Bluetooth: hci0: command tx timeout [ 95.074604][ T24] audit: type=1800 audit(1785847467.163:2): pid=5327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idVendor" dev="configfs" ino=4248 res=0 errno=0 [ 95.117829][ T24] audit: type=1800 audit(1785847467.183:3): pid=5327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idProduct" dev="configfs" ino=4249 res=0 errno=0 [ 95.155380][ T24] audit: type=1800 audit(1785847467.253:4): pid=5327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4273 res=0 errno=0 [ 95.166709][ T5327] [ 95.167751][ T5327] ====================================================== [ 95.170592][ T5327] WARNING: possible circular locking dependency detected [ 95.173399][ T5327] syzkaller #0 Not tainted [ 95.175259][ T5327] ------------------------------------------------------ [ 95.178076][ T5327] syz.0.0/5327 is trying to acquire lock: [ 95.180373][ T5327] ffffffff8fa50d80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 95.184036][ T5327] [ 95.184036][ T5327] but task is already holding lock: [ 95.187040][ T5327] ffff88803543c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 95.190652][ T5327] [ 95.190652][ T5327] which lock already depends on the new lock. [ 95.190652][ T5327] [ 95.194814][ T5327] [ 95.194814][ T5327] the existing dependency chain (in reverse order) is: [ 95.198539][ T5327] [ 95.198539][ T5327] -> #3 (&gi->lock){+.+.}-{4:4}: [ 95.201476][ T5327] __mutex_lock+0x19d/0x1550 [ 95.203565][ T5327] config_usb_cfg_link+0x59/0x260 [ 95.205819][ T5327] configfs_symlink+0x59a/0x1030 [ 95.208025][ T5327] vfs_symlink+0x18b/0x330 [ 95.210030][ T5327] filename_symlinkat+0x1cd/0x410 [ 95.212376][ T5327] __se_sys_symlinkat+0x4e/0x2b0 [ 95.214632][ T5327] do_syscall_64+0x174/0x580 [ 95.216804][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.219376][ T5327] [ 95.219376][ T5327] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 95.222867][ T5327] down_write+0x96/0x200 [ 95.224804][ T5327] configfs_depend_item_unlocked+0x153/0x420 [ 95.227422][ T5327] usbg_make_tpg+0x1f6/0x590 [ 95.229521][ T5327] target_fabric_make_tpg+0xa8/0x6d0 [ 95.231958][ T5327] configfs_mkdir+0x4f6/0x9e0 [ 95.234073][ T5327] vfs_mkdir+0x406/0x620 [ 95.236064][ T5327] filename_mkdirat+0x285/0x510 [ 95.238234][ T5327] __se_sys_mkdirat+0x35/0x150 [ 95.240354][ T5327] do_syscall_64+0x174/0x580 [ 95.242508][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.245271][ T5327] [ 95.245271][ T5327] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 95.248366][ T5327] __mutex_lock+0x19d/0x1550 [ 95.250477][ T5327] usbg_make_tpg+0x147/0x590 [ 95.252566][ T5327] target_fabric_make_tpg+0xa8/0x6d0 [ 95.254983][ T5327] configfs_mkdir+0x4f6/0x9e0 [ 95.257260][ T5327] vfs_mkdir+0x406/0x620 [ 95.259275][ T5327] filename_mkdirat+0x285/0x510 [ 95.261573][ T5327] __se_sys_mkdirat+0x35/0x150 [ 95.263748][ T5327] do_syscall_64+0x174/0x580 [ 95.265932][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.268606][ T5327] [ 95.268606][ T5327] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 95.271820][ T5327] __lock_acquire+0x1520/0x2cf0 [ 95.274085][ T5327] lock_acquire+0x106/0x350 [ 95.276216][ T5327] __mutex_lock+0x19d/0x1550 [ 95.278370][ T5327] tcm_alloc+0x21/0x2e0 [ 95.280299][ T5327] usb_get_function+0x63/0xb0 [ 95.282398][ T5327] config_usb_cfg_link+0x148/0x260 [ 95.284804][ T5327] configfs_symlink+0x59a/0x1030 [ 95.287077][ T5327] vfs_symlink+0x18b/0x330 [ 95.289122][ T5327] filename_symlinkat+0x1cd/0x410 [ 95.291395][ T5327] __se_sys_symlinkat+0x4e/0x2b0 [ 95.293614][ T5327] do_syscall_64+0x174/0x580 [ 95.295748][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.298308][ T5327] [ 95.298308][ T5327] other info that might help us debug this: [ 95.298308][ T5327] [ 95.302330][ T5327] Chain exists of: [ 95.302330][ T5327] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 95.302330][ T5327] [ 95.307833][ T5327] Possible unsafe locking scenario: [ 95.307833][ T5327] [ 95.310812][ T5327] CPU0 CPU1 [ 95.313058][ T5327] ---- ---- [ 95.315266][ T5327] lock(&gi->lock); [ 95.316966][ T5327] lock(&sb->s_type->i_mutex_key#24); [ 95.320165][ T5327] lock(&gi->lock); [ 95.322777][ T5327] lock(tpg_instances_lock); [ 95.324678][ T5327] [ 95.324678][ T5327] *** DEADLOCK *** [ 95.324678][ T5327] [ 95.327945][ T5327] 3 locks held by syz.0.0/5327: [ 95.329928][ T5327] #0: ffff888000e3e450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.333701][ T5327] #1: ffff8880123db0c0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 95.338131][ T5327] #2: ffff88803543c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 95.341883][ T5327] [ 95.341883][ T5327] stack backtrace: [ 95.344258][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.344273][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.344280][ T5327] Call Trace: [ 95.344286][ T5327] [ 95.344292][ T5327] dump_stack_lvl+0xe8/0x150 [ 95.344313][ T5327] print_circular_bug+0x2e1/0x300 [ 95.344329][ T5327] check_noncircular+0x12e/0x150 [ 95.344343][ T5327] __lock_acquire+0x1520/0x2cf0 [ 95.344363][ T5327] ? __lock_acquire+0x13e8/0x2cf0 [ 95.344381][ T5327] ? __pfx_stack_trace_save+0x10/0x10 [ 95.344399][ T5327] ? tcm_alloc+0x21/0x2e0 [ 95.344412][ T5327] lock_acquire+0x106/0x350 [ 95.344428][ T5327] ? tcm_alloc+0x21/0x2e0 [ 95.344444][ T5327] __mutex_lock+0x19d/0x1550 [ 95.344459][ T5327] ? tcm_alloc+0x21/0x2e0 [ 95.344473][ T5327] ? trace_contention_end+0x3d/0x140 [ 95.344485][ T5327] ? __mutex_lock+0x30d/0x1550 [ 95.344499][ T5327] ? tcm_alloc+0x21/0x2e0 [ 95.344513][ T5327] ? __pfx___mutex_lock+0x10/0x10 [ 95.344528][ T5327] ? __pfx___mutex_lock+0x10/0x10 [ 95.344545][ T5327] tcm_alloc+0x21/0x2e0 [ 95.344559][ T5327] usb_get_function+0x63/0xb0 [ 95.344571][ T5327] config_usb_cfg_link+0x148/0x260 [ 95.344587][ T5327] configfs_symlink+0x59a/0x1030 [ 95.344599][ T5327] ? lookup_one_qstr_excl+0x1d4/0x360 [ 95.344615][ T5327] ? make_vfsuid+0x49/0xa0 [ 95.344628][ T5327] ? __pfx_configfs_symlink+0x10/0x10 [ 95.344640][ T5327] ? bpf_lsm_inode_symlink+0x9/0x20 [ 95.344683][ T5327] vfs_symlink+0x18b/0x330 [ 95.344695][ T5327] ? security_path_symlink+0xfd/0x360 [ 95.344709][ T5327] filename_symlinkat+0x1cd/0x410 [ 95.344723][ T5327] ? __pfx_filename_symlinkat+0x10/0x10 [ 95.344737][ T5327] ? do_getname+0x151/0x250 [ 95.344750][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.344763][ T5327] __se_sys_symlinkat+0x4e/0x2b0 [ 95.344775][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.344787][ T5327] do_syscall_64+0x174/0x580 [ 95.344802][ T5327] ? trace_irq_disable+0x3b/0x140 [ 95.344817][ T5327] ? clear_bhb_loop+0x40/0x90 [ 95.344830][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.344844][ T5327] RIP: 0033:0x7f39a6f9e019 [ 95.344861][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.344871][ T5327] RSP: 002b:00007f39a7d95fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 95.344883][ T5327] RAX: ffffffffffffffda RBX: 00007f39a7225fa0 RCX: 00007f39a6f9e019 [ 95.344892][ T5327] RDX: 0000200000000880 RSI: ffffffffffffff9c RDI: 0000200000000840 [ 95.344900][ T5327] RBP: 00007f39a703500c R08: 0000000000000000 R09: 0000000000000000 [ 95.344908][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.344917][ T5327] R13: 00007f39a7226038 R14: 00007f39a7225fa0 R15: 00007ffcee1084d8 [ 95.344929][ T5327] [ 95.482315][ T24] audit: type=1800 audit(1785847467.573:5): pid=5328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4277 res=0 errno=0 [ 95.725042][ T5312] usb 5-1: new high-speed USB device number 2 using dummy_hcd