program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000880)='naa.6001405123456789\x00', 0x14) symlinkat(&(0x7f00000008c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000980)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r6 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f0000000200)=""/28}, &(0x7f0000000300)="5f000000000000001c00", &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0}) [ 85.212578][ T24] audit: type=1800 audit(1785850172.253:2): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4253 res=0 errno=0 [ 85.234833][ T24] audit: type=1800 audit(1785850172.263:3): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idVendor" dev="configfs" ino=4260 res=0 errno=0 [ 85.250737][ T5324] [ 85.251588][ T5324] ====================================================== [ 85.253884][ T5324] WARNING: possible circular locking dependency detected [ 85.256547][ T5324] syzkaller #0 Not tainted [ 85.258274][ T5324] ------------------------------------------------------ [ 85.261122][ T5324] syz.0.0/5324 is trying to acquire lock: [ 85.263430][ T5324] ffffffff8fa50d80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 85.267095][ T5324] [ 85.267095][ T5324] but task is already holding lock: [ 85.270687][ T5324] ffff888012aba390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.274569][ T5324] [ 85.274569][ T5324] which lock already depends on the new lock. [ 85.274569][ T5324] [ 85.279264][ T5324] [ 85.279264][ T5324] the existing dependency chain (in reverse order) is: [ 85.283612][ T5324] [ 85.283612][ T5324] -> #3 (&gi->lock){+.+.}-{4:4}: [ 85.286543][ T5324] __mutex_lock+0x19d/0x1550 [ 85.288718][ T5324] config_usb_cfg_link+0x59/0x260 [ 85.290991][ T5324] configfs_symlink+0x59a/0x1030 [ 85.293264][ T5324] vfs_symlink+0x18b/0x330 [ 85.295428][ T5324] filename_symlinkat+0x1cd/0x410 [ 85.297707][ T5324] __se_sys_symlinkat+0x4e/0x2b0 [ 85.300078][ T5324] do_syscall_64+0x174/0x580 [ 85.302230][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.304909][ T5324] [ 85.304909][ T5324] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 85.308556][ T5324] down_write+0x96/0x200 [ 85.310512][ T5324] configfs_depend_item_unlocked+0x153/0x420 [ 85.313212][ T5324] usbg_make_tpg+0x1f6/0x590 [ 85.315352][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 85.317839][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 85.320485][ T5324] vfs_mkdir+0x406/0x620 [ 85.322595][ T5324] filename_mkdirat+0x285/0x510 [ 85.324924][ T5324] __se_sys_mkdirat+0x35/0x150 [ 85.327162][ T5324] do_syscall_64+0x174/0x580 [ 85.329340][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.331931][ T5324] [ 85.331931][ T5324] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 85.335101][ T5324] __mutex_lock+0x19d/0x1550 [ 85.337225][ T5324] usbg_make_tpg+0x147/0x590 [ 85.339346][ T5324] target_fabric_make_tpg+0xa8/0x6d0 [ 85.341838][ T5324] configfs_mkdir+0x4f6/0x9e0 [ 85.343964][ T5324] vfs_mkdir+0x406/0x620 [ 85.345952][ T5324] filename_mkdirat+0x285/0x510 [ 85.347802][ T5324] __se_sys_mkdirat+0x35/0x150 [ 85.349909][ T5324] do_syscall_64+0x174/0x580 [ 85.352129][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.354845][ T5324] [ 85.354845][ T5324] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 85.357792][ T5324] __lock_acquire+0x1520/0x2cf0 [ 85.359593][ T5324] lock_acquire+0x106/0x350 [ 85.361275][ T5324] __mutex_lock+0x19d/0x1550 [ 85.362952][ T5324] tcm_alloc+0x21/0x2e0 [ 85.364649][ T5324] usb_get_function+0x63/0xb0 [ 85.366894][ T5324] config_usb_cfg_link+0x148/0x260 [ 85.369221][ T5324] configfs_symlink+0x59a/0x1030 [ 85.371550][ T5324] vfs_symlink+0x18b/0x330 [ 85.374084][ T5324] filename_symlinkat+0x1cd/0x410 [ 85.376672][ T5324] __se_sys_symlinkat+0x4e/0x2b0 [ 85.378907][ T5324] do_syscall_64+0x174/0x580 [ 85.380993][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.383597][ T5324] [ 85.383597][ T5324] other info that might help us debug this: [ 85.383597][ T5324] [ 85.387771][ T5324] Chain exists of: [ 85.387771][ T5324] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 85.387771][ T5324] [ 85.393377][ T5324] Possible unsafe locking scenario: [ 85.393377][ T5324] [ 85.396427][ T5324] CPU0 CPU1 [ 85.398879][ T5324] ---- ---- [ 85.401414][ T5324] lock(&gi->lock); [ 85.403090][ T5324] lock(&sb->s_type->i_mutex_key#24); [ 85.406453][ T5324] lock(&gi->lock); [ 85.409136][ T5324] lock(tpg_instances_lock); [ 85.411124][ T5324] [ 85.411124][ T5324] *** DEADLOCK *** [ 85.411124][ T5324] [ 85.414652][ T5324] 3 locks held by syz.0.0/5324: [ 85.416744][ T5324] #0: ffff888000326450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 85.420614][ T5324] #1: ffff888013248600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 85.425063][ T5324] #2: ffff888012aba390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 85.429209][ T5324] [ 85.429209][ T5324] stack backtrace: [ 85.432153][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.432169][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.432177][ T5324] Call Trace: [ 85.432184][ T5324] [ 85.432190][ T5324] dump_stack_lvl+0xe8/0x150 [ 85.432211][ T5324] print_circular_bug+0x2e1/0x300 [ 85.432225][ T5324] check_noncircular+0x12e/0x150 [ 85.432240][ T5324] __lock_acquire+0x1520/0x2cf0 [ 85.432257][ T5324] ? __lock_acquire+0x13e8/0x2cf0 [ 85.432273][ T5324] ? lockdep_hardirqs_on+0x7a/0x110 [ 85.432289][ T5324] ? tcm_alloc+0x21/0x2e0 [ 85.432305][ T5324] lock_acquire+0x106/0x350 [ 85.432320][ T5324] ? tcm_alloc+0x21/0x2e0 [ 85.432334][ T5324] __mutex_lock+0x19d/0x1550 [ 85.432348][ T5324] ? tcm_alloc+0x21/0x2e0 [ 85.432362][ T5324] ? trace_contention_end+0x3d/0x140 [ 85.432373][ T5324] ? __mutex_lock+0x30d/0x1550 [ 85.432386][ T5324] ? tcm_alloc+0x21/0x2e0 [ 85.432398][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 85.432412][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 85.432428][ T5324] tcm_alloc+0x21/0x2e0 [ 85.432440][ T5324] usb_get_function+0x63/0xb0 [ 85.432453][ T5324] config_usb_cfg_link+0x148/0x260 [ 85.432466][ T5324] configfs_symlink+0x59a/0x1030 [ 85.432478][ T5324] ? lookup_one_qstr_excl+0x1d4/0x360 [ 85.432492][ T5324] ? make_vfsuid+0x49/0xa0 [ 85.432512][ T5324] ? __pfx_configfs_symlink+0x10/0x10 [ 85.432524][ T5324] ? bpf_lsm_inode_symlink+0x9/0x20 [ 85.432543][ T5324] vfs_symlink+0x18b/0x330 [ 85.432554][ T5324] ? security_path_symlink+0xfd/0x360 [ 85.432567][ T5324] filename_symlinkat+0x1cd/0x410 [ 85.432580][ T5324] ? __pfx_filename_symlinkat+0x10/0x10 [ 85.432591][ T5324] ? do_getname+0x151/0x250 [ 85.432602][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.432613][ T5324] __se_sys_symlinkat+0x4e/0x2b0 [ 85.432624][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.432634][ T5324] do_syscall_64+0x174/0x580 [ 85.432647][ T5324] ? trace_irq_disable+0x3b/0x140 [ 85.432661][ T5324] ? clear_bhb_loop+0x40/0x90 [ 85.432672][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.432683][ T5324] RIP: 0033:0x7f8ba239e019 [ 85.432694][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.432703][ T5324] RSP: 002b:00007f8ba319dfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 85.432715][ T5324] RAX: ffffffffffffffda RBX: 00007f8ba2625fa0 RCX: 00007f8ba239e019 [ 85.432724][ T5324] RDX: 0000200000000900 RSI: ffffffffffffff9c RDI: 00002000000008c0 [ 85.432731][ T5324] RBP: 00007f8ba243500c R08: 0000000000000000 R09: 0000000000000000 [ 85.432739][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.432746][ T5324] R13: 00007f8ba2626038 R14: 00007f8ba2625fa0 R15: 00007fff99d52878 [ 85.432757][ T5324] [ 85.551439][ T24] audit: type=1800 audit(1785850172.263:4): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="idProduct" dev="configfs" ino=4261 res=0 errno=0 [ 85.559679][ T24] audit: type=1800 audit(1785850172.293:5): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="nexus" dev="configfs" ino=4282 res=0 errno=0 [ 85.576993][ T24] audit: type=1800 audit(1785850172.623:6): pid=5325 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4283 res=0 errno=0 [ 85.585412][ T5325] udc dummy_udc.0: failed to start g1: -19 [ 85.590779][ T5325] UDC core: g1: couldn't find an available UDC or it's busy [ 85.608949][ T5285] Bluetooth: hci0: command tx timeout