program: mkdir(&(0x7f00000001c0)='./my_configfs\x00', 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newtfilter={0x70, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xa}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x94}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x1c, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_LVALUE={0x4}]}}]}]}]}}]}, 0x70}}, 0x800) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs/target/core/rd_mcp_0\x00', 0x41a000, 0x1d0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='naa.', 0x4) getdents(r3, &(0x7f0000000080)=""/106, 0x6a) rmdir(&(0x7f0000001640)='./my_configfs/target/core/rd_mcp_0\x00') [ 109.913782][ T5280] Bluetooth: hci0: command tx timeout [ 110.011607][ T5322] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 110.110698][ T5322] [ 110.112010][ T5322] ====================================================== [ 110.115519][ T5322] WARNING: possible circular locking dependency detected [ 110.118672][ T5322] syzkaller #0 Not tainted [ 110.120451][ T5322] ------------------------------------------------------ [ 110.123303][ T5322] syz.0.0/5322 is trying to acquire lock: [ 110.125866][ T5322] ffffffff8f93c568 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 110.130962][ T5322] [ 110.130962][ T5322] but task is already holding lock: [ 110.134278][ T5322] ffff88801fd6ba40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 110.138053][ T5322] [ 110.138053][ T5322] which lock already depends on the new lock. [ 110.138053][ T5322] [ 110.142753][ T5322] [ 110.142753][ T5322] the existing dependency chain (in reverse order) is: [ 110.146814][ T5322] [ 110.146814][ T5322] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 110.151184][ T5322] down_write+0x96/0x200 [ 110.154046][ T5322] configfs_depend_item_unlocked+0x153/0x420 [ 110.157416][ T5322] usbg_make_tpg+0x1e0/0x550 [ 110.159748][ T5322] target_fabric_make_tpg+0xa8/0x6d0 [ 110.162535][ T5322] configfs_mkdir+0x4f6/0x9e0 [ 110.165114][ T5322] vfs_mkdir+0x40c/0x620 [ 110.167428][ T5322] filename_mkdirat+0x285/0x510 [ 110.170341][ T5322] __se_sys_mkdirat+0x35/0x150 [ 110.173872][ T5322] do_syscall_64+0x166/0x520 [ 110.177239][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.180077][ T5322] [ 110.180077][ T5322] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 110.183709][ T5322] __mutex_lock+0x19d/0x1550 [ 110.185985][ T5322] usbg_make_tpg+0xf8/0x550 [ 110.188526][ T5322] target_fabric_make_tpg+0xa8/0x6d0 [ 110.191836][ T5322] configfs_mkdir+0x4f6/0x9e0 [ 110.194623][ T5322] vfs_mkdir+0x40c/0x620 [ 110.196742][ T5322] filename_mkdirat+0x285/0x510 [ 110.199046][ T5322] __se_sys_mkdirat+0x35/0x150 [ 110.201221][ T5322] do_syscall_64+0x166/0x520 [ 110.203598][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.206911][ T5322] [ 110.206911][ T5322] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 110.210651][ T5322] __lock_acquire+0x164c/0x2de0 [ 110.212964][ T5322] lock_acquire+0x115/0x350 [ 110.215203][ T5322] __mutex_lock+0x19d/0x1550 [ 110.217371][ T5322] configfs_rmdir+0x5f0/0x950 [ 110.220067][ T5322] vfs_rmdir+0x3e6/0x6a0 [ 110.222789][ T5322] filename_rmdir+0x292/0x520 [ 110.225291][ T5322] __se_sys_rmdir+0x2e/0x140 [ 110.228078][ T5322] do_syscall_64+0x166/0x520 [ 110.230937][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.233963][ T5322] [ 110.233963][ T5322] other info that might help us debug this: [ 110.233963][ T5322] [ 110.237704][ T5322] Chain exists of: [ 110.237704][ T5322] &subsys->su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 110.237704][ T5322] [ 110.242918][ T5322] Possible unsafe locking scenario: [ 110.242918][ T5322] [ 110.246031][ T5322] CPU0 CPU1 [ 110.248620][ T5322] ---- ---- [ 110.251731][ T5322] lock(&sb->s_type->i_mutex_key#24); [ 110.254269][ T5322] lock(tpg_instances_lock); [ 110.257770][ T5322] lock(&sb->s_type->i_mutex_key#24); [ 110.261139][ T5322] lock(&subsys->su_mutex); [ 110.263068][ T5322] [ 110.263068][ T5322] *** DEADLOCK *** [ 110.263068][ T5322] [ 110.266449][ T5322] locks held by syz.0.0/5322: 3, last CPU#0: [ 110.269431][ T5322] #0: ffff888000a60460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 110.273924][ T5322] #1: ffff88800080f0c0 (&default_group_class[depth - 1]#7/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 [ 110.278438][ T5322] #2: ffff88801fd6ba40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 110.282821][ T5322] [ 110.282821][ T5322] stack backtrace: [ 110.285415][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 110.289940][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.294664][ T5322] Call Trace: [ 110.296233][ T5322] [ 110.297643][ T5322] dump_stack_lvl+0xe8/0x150 [ 110.299686][ T5322] print_circular_bug+0x2e2/0x300 [ 110.302273][ T5322] check_noncircular+0x12f/0x150 [ 110.305313][ T5322] __lock_acquire+0x164c/0x2de0 [ 110.308086][ T5322] ? __bfs+0x153/0x290 [ 110.309973][ T5322] ? __pfx_hlock_conflict+0x10/0x10 [ 110.312409][ T5322] ? check_path+0x21/0x40 [ 110.314429][ T5322] ? check_noncircular+0xdb/0x150 [ 110.316661][ T5322] lock_acquire+0x115/0x350 [ 110.318955][ T5322] ? configfs_rmdir+0x5f0/0x950 [ 110.322110][ T5322] __mutex_lock+0x19d/0x1550 [ 110.324851][ T5322] ? configfs_rmdir+0x5f0/0x950 [ 110.327183][ T5322] ? reacquire_held_locks+0x117/0x1a0 [ 110.329614][ T5322] ? configfs_rmdir+0x5f0/0x950 [ 110.331771][ T5322] ? __pfx___mutex_lock+0x10/0x10 [ 110.333982][ T5322] ? _raw_spin_unlock+0x28/0x50 [ 110.336218][ T5322] ? fast_dput+0x481/0x690 [ 110.338316][ T5322] configfs_rmdir+0x5f0/0x950 [ 110.340649][ T5322] vfs_rmdir+0x3e6/0x6a0 [ 110.342757][ T5322] ? bpf_lsm_path_rmdir+0x9/0x20 [ 110.345556][ T5322] filename_rmdir+0x292/0x520 [ 110.347912][ T5322] ? __pfx_filename_rmdir+0x10/0x10 [ 110.350088][ T5322] ? do_getname+0x151/0x250 [ 110.352067][ T5322] __se_sys_rmdir+0x2e/0x140 [ 110.354077][ T5322] do_syscall_64+0x166/0x520 [ 110.356026][ T5322] ? trace_irq_disable+0x3b/0x140 [ 110.358421][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.361564][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 110.364254][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.367001][ T5322] RIP: 0033:0x7f770a59e159 [ 110.368972][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.376680][ T5322] RSP: 002b:00007f770b425fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 110.380993][ T5322] RAX: ffffffffffffffda RBX: 00007f770a825fa0 RCX: 00007f770a59e159 [ 110.384771][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000001640 [ 110.388216][ T5322] RBP: 00007f770a63506b R08: 0000000000000000 R09: 0000000000000000 [ 110.391648][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.395470][ T5322] R13: 00007f770a826038 R14: 00007f770a825fa0 R15: 00007ffe31f5ea48 [ 110.399493][ T5322]