program: mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) capset(&(0x7f00000001c0)={0x20080522}, &(0x7f0000000240)={0x0, 0x2, 0x0, 0x0, 0x0, 0x4}) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(r0, 0x560c, 0x0) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) rmdir(&(0x7f0000000140)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00') rmdir(&(0x7f0000000040)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00') utime(&(0x7f0000000080)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', &(0x7f00000000c0)={0x0, 0x7}) r1 = fsopen(&(0x7f0000000180)='gfs2\x00', 0x1) r2 = gettid() tkill(r2, 0x21) fcntl$setown(r1, 0x8, r2) [ 94.686993][ T4667] Bluetooth: hci0: command tx timeout [ 94.954553][ T5346] [ 94.955931][ T5346] ====================================================== [ 94.959511][ T5346] WARNING: possible circular locking dependency detected [ 94.962919][ T5346] syzkaller #0 Not tainted [ 94.965336][ T5346] ------------------------------------------------------ [ 94.968768][ T5346] syz.0.0/5346 is trying to acquire lock: [ 94.971303][ T5346] ffffffff90d5c228 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 94.975868][ T5346] [ 94.975868][ T5346] but task is already holding lock: [ 94.978957][ T5346] ffff888014142740 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xf8/0x6f0 [ 94.983888][ T5346] [ 94.983888][ T5346] which lock already depends on the new lock. [ 94.983888][ T5346] [ 94.988898][ T5346] [ 94.988898][ T5346] the existing dependency chain (in reverse order) is: [ 94.993381][ T5346] [ 94.993381][ T5346] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 94.997576][ T5346] down_write+0x91/0x200 [ 94.999690][ T5346] configfs_depend_item_unlocked+0x153/0x420 [ 95.002414][ T5346] usbg_make_tpg+0x1e0/0x550 [ 95.004944][ T5346] target_fabric_make_tpg+0xa8/0x6d0 [ 95.008004][ T5346] configfs_mkdir+0x4f6/0x9e0 [ 95.010535][ T5346] vfs_mkdir+0x411/0x660 [ 95.012778][ T5346] filename_mkdirat+0x284/0x550 [ 95.015150][ T5346] __se_sys_mkdir+0x34/0x150 [ 95.017269][ T5346] do_syscall_64+0x166/0x520 [ 95.019436][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.023084][ T5346] [ 95.023084][ T5346] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 95.027078][ T5346] __mutex_lock+0x197/0x15a0 [ 95.029681][ T5346] usbg_make_tpg+0xf8/0x550 [ 95.032316][ T5346] target_fabric_make_tpg+0xa8/0x6d0 [ 95.035560][ T5346] configfs_mkdir+0x4f6/0x9e0 [ 95.038164][ T5346] vfs_mkdir+0x411/0x660 [ 95.040580][ T5346] filename_mkdirat+0x284/0x550 [ 95.043370][ T5346] __se_sys_mkdir+0x34/0x150 [ 95.046034][ T5346] do_syscall_64+0x166/0x520 [ 95.048576][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.051770][ T5346] [ 95.051770][ T5346] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 95.055750][ T5346] __lock_acquire+0x164c/0x2de0 [ 95.058608][ T5346] lock_acquire+0x115/0x350 [ 95.061270][ T5346] __mutex_lock+0x197/0x15a0 [ 95.063765][ T5346] configfs_rmdir+0x5f0/0x950 [ 95.066237][ T5346] vfs_rmdir+0x3e6/0x6f0 [ 95.068670][ T5346] filename_rmdir+0x276/0x500 [ 95.071279][ T5346] __se_sys_rmdir+0x2e/0x140 [ 95.074107][ T5346] do_syscall_64+0x166/0x520 [ 95.076771][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.079816][ T5346] [ 95.079816][ T5346] other info that might help us debug this: [ 95.079816][ T5346] [ 95.085186][ T5346] Chain exists of: [ 95.085186][ T5346] &subsys->su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 95.085186][ T5346] [ 95.093419][ T5346] Possible unsafe locking scenario: [ 95.093419][ T5346] [ 95.097742][ T5346] CPU0 CPU1 [ 95.100848][ T5346] ---- ---- [ 95.104488][ T5346] lock(&sb->s_type->i_mutex_key#24); [ 95.108431][ T5346] lock(tpg_instances_lock); [ 95.113706][ T5346] lock(&sb->s_type->i_mutex_key#24); [ 95.118932][ T5346] lock(&subsys->su_mutex); [ 95.121534][ T5346] [ 95.121534][ T5346] *** DEADLOCK *** [ 95.121534][ T5346] [ 95.125516][ T5346] locks held by syz.0.0/5346: 3, last CPU#0: [ 95.128821][ T5346] #0: ffff888033398478 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.133835][ T5346] #1: ffff888014149440 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_rmdir+0x1c4/0x500 [ 95.144138][ T5346] #2: ffff888014142740 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xf8/0x6f0 [ 95.152063][ T5346] [ 95.152063][ T5346] stack backtrace: [ 95.157065][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.162056][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.167591][ T5346] Call Trace: [ 95.169594][ T5346] [ 95.171146][ T5346] dump_stack_lvl+0xe8/0x150 [ 95.173848][ T5346] print_circular_bug+0x2e2/0x300 [ 95.176867][ T5346] check_noncircular+0x12f/0x150 [ 95.179856][ T5346] __lock_acquire+0x164c/0x2de0 [ 95.182679][ T5346] ? set_normalized_timespec64+0xf0/0x1a0 [ 95.186248][ T5346] ? __lock_acquire+0x747/0x2de0 [ 95.189624][ T5346] lock_acquire+0x115/0x350 [ 95.192133][ T5346] ? configfs_rmdir+0x5f0/0x950 [ 95.194564][ T5346] __mutex_lock+0x197/0x15a0 [ 95.196829][ T5346] ? configfs_rmdir+0x5f0/0x950 [ 95.199149][ T5346] ? reacquire_held_locks+0x117/0x1a0 [ 95.202205][ T5346] ? configfs_rmdir+0x5f0/0x950 [ 95.204957][ T5346] ? __pfx___mutex_lock+0x10/0x10 [ 95.207936][ T5346] ? _raw_spin_unlock+0x28/0x50 [ 95.210784][ T5346] ? fast_dput+0x481/0x690 [ 95.213410][ T5346] configfs_rmdir+0x5f0/0x950 [ 95.216530][ T5346] vfs_rmdir+0x3e6/0x6f0 [ 95.219159][ T5346] ? bpf_lsm_path_rmdir+0x9/0x20 [ 95.222385][ T5346] filename_rmdir+0x276/0x500 [ 95.225267][ T5346] ? __pfx_filename_rmdir+0x10/0x10 [ 95.228262][ T5346] ? do_getname+0x151/0x250 [ 95.230946][ T5346] __se_sys_rmdir+0x2e/0x140 [ 95.233820][ T5346] do_syscall_64+0x166/0x520 [ 95.236619][ T5346] ? trace_irq_disable+0x3b/0x140 [ 95.241180][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.244695][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 95.247436][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.250907][ T5346] RIP: 0033:0x7f51e0b9fb19 [ 95.253767][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.265334][ T5346] RSP: 002b:00007f51dcff4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 95.270306][ T5346] RAX: ffffffffffffffda RBX: 00007f51e0e25fa0 RCX: 00007f51e0b9fb19 [ 95.275054][ T5346] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 95.279820][ T5346] RBP: 00007f51e0c37b70 R08: 0000000000000000 R09: 0000000000000000 [ 95.284688][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.289313][ T5346] R13: 00007f51e0e26038 R14: 00007f51e0e25fa0 R15: 00007ffccccb7628 [ 95.293863][ T5346]