program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/ramdisk_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/ramdisk_0/rd\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/ramdisk_0/rd/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/ramdisk_0/rd/enable\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000740)='./config/target/core/ramdisk_0/rd\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/port1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000800)='1\x00', 0x1) symlinkat(&(0x7f0000000840)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000900)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000940)={0x1}, 0x0) [ 88.818000][ T5321] [ 88.818975][ T5321] ====================================================== [ 88.821393][ T5321] WARNING: possible circular locking dependency detected [ 88.823617][ T5321] syzkaller #0 Not tainted [ 88.825233][ T5321] ------------------------------------------------------ [ 88.827491][ T5321] syz.0.0/5321 is trying to acquire lock: [ 88.829352][ T5321] ffffffff8fa50d80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 88.832310][ T5321] [ 88.832310][ T5321] but task is already holding lock: [ 88.834800][ T5321] ffff888012d1a390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 88.838020][ T5321] [ 88.838020][ T5321] which lock already depends on the new lock. [ 88.838020][ T5321] [ 88.841345][ T5321] [ 88.841345][ T5321] the existing dependency chain (in reverse order) is: [ 88.844198][ T5321] [ 88.844198][ T5321] -> #3 (&gi->lock){+.+.}-{4:4}: [ 88.846505][ T5321] __mutex_lock+0x19d/0x1550 [ 88.848330][ T5321] config_usb_cfg_link+0x59/0x260 [ 88.854450][ T5321] configfs_symlink+0x59a/0x1030 [ 88.857115][ T5321] vfs_symlink+0x18b/0x330 [ 88.858780][ T5321] filename_symlinkat+0x1cd/0x410 [ 88.860567][ T5321] __se_sys_symlinkat+0x4e/0x2b0 [ 88.862373][ T5321] do_syscall_64+0x174/0x580 [ 88.864075][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.866148][ T5321] [ 88.866148][ T5321] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 88.868918][ T5321] down_write+0x96/0x200 [ 88.870499][ T5321] configfs_depend_item_unlocked+0x153/0x420 [ 88.872885][ T5321] usbg_make_tpg+0x1f6/0x590 [ 88.874857][ T5321] target_fabric_make_tpg+0xa8/0x6d0 [ 88.877086][ T5321] configfs_mkdir+0x4f6/0x9e0 [ 88.879024][ T5321] vfs_mkdir+0x406/0x620 [ 88.880895][ T5321] filename_mkdirat+0x285/0x510 [ 88.882907][ T5321] __se_sys_mkdirat+0x35/0x150 [ 88.884944][ T5321] do_syscall_64+0x174/0x580 [ 88.886855][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.889197][ T5321] [ 88.889197][ T5321] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 88.892045][ T5321] __mutex_lock+0x19d/0x1550 [ 88.893949][ T5321] usbg_make_tpg+0x147/0x590 [ 88.895743][ T5321] target_fabric_make_tpg+0xa8/0x6d0 [ 88.897611][ T5321] configfs_mkdir+0x4f6/0x9e0 [ 88.899456][ T5321] vfs_mkdir+0x406/0x620 [ 88.900958][ T5321] filename_mkdirat+0x285/0x510 [ 88.902687][ T5321] __se_sys_mkdirat+0x35/0x150 [ 88.904547][ T5321] do_syscall_64+0x174/0x580 [ 88.906397][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.908784][ T5321] [ 88.908784][ T5321] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 88.911760][ T5321] __lock_acquire+0x1520/0x2cf0 [ 88.913761][ T5321] lock_acquire+0x106/0x350 [ 88.915739][ T5321] __mutex_lock+0x19d/0x1550 [ 88.917657][ T5321] tcm_alloc+0x21/0x2e0 [ 88.919328][ T5321] usb_get_function+0x63/0xb0 [ 88.921104][ T5321] config_usb_cfg_link+0x148/0x260 [ 88.923003][ T5321] configfs_symlink+0x59a/0x1030 [ 88.924965][ T5321] vfs_symlink+0x18b/0x330 [ 88.926779][ T5321] filename_symlinkat+0x1cd/0x410 [ 88.928626][ T5321] __se_sys_symlinkat+0x4e/0x2b0 [ 88.930349][ T5321] do_syscall_64+0x174/0x580 [ 88.931963][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.933941][ T5321] [ 88.933941][ T5321] other info that might help us debug this: [ 88.933941][ T5321] [ 88.937106][ T5321] Chain exists of: [ 88.937106][ T5321] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 88.937106][ T5321] [ 88.941290][ T5321] Possible unsafe locking scenario: [ 88.941290][ T5321] [ 88.943667][ T5321] CPU0 CPU1 [ 88.945371][ T5321] ---- ---- [ 88.947105][ T5321] lock(&gi->lock); [ 88.948377][ T5321] lock(&sb->s_type->i_mutex_key#24); [ 88.950817][ T5321] lock(&gi->lock); [ 88.953012][ T5321] lock(tpg_instances_lock); [ 88.954669][ T5321] [ 88.954669][ T5321] *** DEADLOCK *** [ 88.954669][ T5321] [ 88.957500][ T5321] 3 locks held by syz.0.0/5321: [ 88.959236][ T5321] #0: ffff888000b26450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 88.962476][ T5321] #1: ffff888042b70600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 88.966105][ T5321] #2: ffff888012d1a390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 88.969550][ T5321] [ 88.969550][ T5321] stack backtrace: [ 88.971530][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 88.971539][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.971545][ T5321] Call Trace: [ 88.971549][ T5321] [ 88.971553][ T5321] dump_stack_lvl+0xe8/0x150 [ 88.971567][ T5321] print_circular_bug+0x2e1/0x300 [ 88.971576][ T5321] check_noncircular+0x12e/0x150 [ 88.971585][ T5321] __lock_acquire+0x1520/0x2cf0 [ 88.971597][ T5321] ? __lock_acquire+0x13e8/0x2cf0 [ 88.971608][ T5321] ? __pfx_stack_trace_save+0x10/0x10 [ 88.971620][ T5321] ? tcm_alloc+0x21/0x2e0 [ 88.971628][ T5321] lock_acquire+0x106/0x350 [ 88.971638][ T5321] ? tcm_alloc+0x21/0x2e0 [ 88.971647][ T5321] __mutex_lock+0x19d/0x1550 [ 88.971657][ T5321] ? tcm_alloc+0x21/0x2e0 [ 88.971665][ T5321] ? trace_contention_end+0x3d/0x140 [ 88.971673][ T5321] ? __mutex_lock+0x30d/0x1550 [ 88.971682][ T5321] ? tcm_alloc+0x21/0x2e0 [ 88.971690][ T5321] ? __pfx___mutex_lock+0x10/0x10 [ 88.971700][ T5321] ? __pfx___mutex_lock+0x10/0x10 [ 88.971711][ T5321] tcm_alloc+0x21/0x2e0 [ 88.971719][ T5321] usb_get_function+0x63/0xb0 [ 88.971727][ T5321] config_usb_cfg_link+0x148/0x260 [ 88.971736][ T5321] configfs_symlink+0x59a/0x1030 [ 88.971744][ T5321] ? lookup_one_qstr_excl+0x1d4/0x360 [ 88.971753][ T5321] ? make_vfsuid+0x49/0xa0 [ 88.971760][ T5321] ? __pfx_configfs_symlink+0x10/0x10 [ 88.971767][ T5321] ? bpf_lsm_inode_symlink+0x9/0x20 [ 88.971778][ T5321] vfs_symlink+0x18b/0x330 [ 88.971785][ T5321] ? security_path_symlink+0xfd/0x360 [ 88.971793][ T5321] filename_symlinkat+0x1cd/0x410 [ 88.971801][ T5321] ? __pfx_filename_symlinkat+0x10/0x10 [ 88.971808][ T5321] ? do_getname+0x151/0x250 [ 88.971815][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.971822][ T5321] __se_sys_symlinkat+0x4e/0x2b0 [ 88.971828][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.971835][ T5321] do_syscall_64+0x174/0x580 [ 88.971843][ T5321] ? trace_irq_disable+0x3b/0x140 [ 88.971853][ T5321] ? clear_bhb_loop+0x40/0x90 [ 88.971860][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.971867][ T5321] RIP: 0033:0x7fd4e1d9e019 [ 88.971876][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.971882][ T5321] RSP: 002b:00007fd4e2ce0fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 88.971890][ T5321] RAX: ffffffffffffffda RBX: 00007fd4e2025fa0 RCX: 00007fd4e1d9e019 [ 88.971895][ T5321] RDX: 0000200000000880 RSI: ffffffffffffff9c RDI: 0000200000000840 [ 88.971900][ T5321] RBP: 00007fd4e1e3500c R08: 0000000000000000 R09: 0000000000000000 [ 88.971904][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.971908][ T5321] R13: 00007fd4e2026038 R14: 00007fd4e2025fa0 R15: 00007ffd87b665a8 [ 88.971921][ T5321] [ 89.067281][ T24] audit: type=1800 audit(1785848890.100:2): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idVendor" dev="configfs" ino=4232 res=0 errno=0 [ 89.074018][ T5283] Bluetooth: hci0: command tx timeout [ 89.093877][ T24] audit: type=1800 audit(1785848890.100:3): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idProduct" dev="configfs" ino=4233 res=0 errno=0 [ 89.106879][ T24] audit: type=1800 audit(1785848890.110:4): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4255 res=0 errno=0 [ 89.113010][ T24] audit: type=1800 audit(1785848890.360:5): pid=5322 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4256 res=0 errno=0 [ 89.359700][ T5300] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 89.512035][ T5300] usb 5-1: Dual-Role OTG device on HNP port [ 89.514749][ T5300] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02 [ 89.518486][ T5300] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.536892][ T9] Using the BOT protocol [ 89.543890][ T9] Using the UAS protocol [ 89.551259][ T5300] scsi host6: uas [ 89.563912][ C0] Missing nexus, ignoring command