loop2: detected capacity change from 0 to 512
FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.2.930/11350 is trying to acquire lock:
ffff800089690b08 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x47c drivers/usb/gadget/function/uvc_configfs.c:1750

but task is already holding lock:
ffff0000da9f4600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
ffff0000da9f4600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x400/0xfb4 fs/configfs/symlink.c:201

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&sb->s_type->i_mutex_key#28){++++}-{4:4}:
       down_write+0xac/0x2a8 kernel/locking/rwsem.c:1631
       inode_lock include/linux/fs.h:1024 [inline]
       configfs_depend_item_unlocked+0x154/0x344 fs/configfs/dir.c:1268
       usbg_make_tpg+0x218/0x4a0 drivers/usb/gadget/function/f_tcm.c:1692
       target_fabric_make_tpg+0x98/0x518 drivers/target/target_core_fabric_configfs.c:947
       configfs_mkdir+0x374/0x7d4 fs/configfs/dir.c:1369
       vfs_mkdir+0x2e4/0x46c fs/namei.c:5410
       filename_mkdirat+0x228/0x3f4 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x9c/0xc0 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
       do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
       el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
       el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

-> #2 (tpg_instances_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x164/0x1078 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       tcm_alloc_inst+0x6c/0x190 drivers/usb/gadget/function/f_tcm.c:2687
       try_get_usb_function_instance+0xe4/0x164 drivers/usb/gadget/functions.c:28
       usb_get_function_instance+0x24/0xb0 drivers/usb/gadget/functions.c:44
       function_make+0x110/0x300 drivers/usb/gadget/configfs.c:626
       configfs_mkdir+0x374/0x7d4 fs/configfs/dir.c:1369
       vfs_mkdir+0x2e4/0x46c fs/namei.c:5410
       filename_mkdirat+0x228/0x3f4 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x9c/0xc0 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
       do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
       el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
       el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

-> #1 (func_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x164/0x1078 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       try_get_usb_function_instance+0x38/0x164 drivers/usb/gadget/functions.c:18
       usb_get_function_instance+0x24/0xb0 drivers/usb/gadget/functions.c:44
       function_make+0x110/0x300 drivers/usb/gadget/configfs.c:626
       configfs_mkdir+0x374/0x7d4 fs/configfs/dir.c:1369
       vfs_mkdir+0x2e4/0x46c fs/namei.c:5410
       filename_mkdirat+0x228/0x3f4 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x9c/0xc0 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
       do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
       el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
       el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

-> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x1660/0x2b08 kernel/locking/lockdep.c:5288
       lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x164/0x1078 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       uvcg_streaming_header_allow_link+0x7c/0x47c drivers/usb/gadget/function/uvc_configfs.c:1750
       configfs_symlink+0x5ec/0xfb4 fs/configfs/symlink.c:211
       vfs_symlink+0x16c/0x290 fs/namei.c:5794
       filename_symlinkat+0x18c/0x328 fs/namei.c:5819
       __do_sys_symlinkat fs/namei.c:5839 [inline]
       __se_sys_symlinkat fs/namei.c:5834 [inline]
       __arm64_sys_symlinkat+0xb0/0xdc fs/namei.c:5834
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
       el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
       do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
       el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
       el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
       el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

other info that might help us debug this:

Chain exists of:
  gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#28

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sb->s_type->i_mutex_key#28);
                               lock(tpg_instances_lock);
                               lock(&sb->s_type->i_mutex_key#28);
  lock(gadget_subsys.su_mutex);

 *** DEADLOCK ***

locks held by syz.2.930/11350: 2, last CPU#0:
 #0: ffff0000c407a460 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:494
 #1: ffff0000da9f4600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff0000da9f4600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: configfs_symlink+0x400/0xfb4 fs/configfs/symlink.c:201

stack backtrace:
CPU: 0 UID: 0 PID: 11350 Comm: syz.2.930 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
dump_backtrace(regs = 0000000000000000 tsk = 0000000000000000)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2087
 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x1660/0x2b08 kernel/locking/lockdep.c:5288
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x164/0x1078 kernel/locking/mutex.c:821
 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
 uvcg_streaming_header_allow_link+0x7c/0x47c drivers/usb/gadget/function/uvc_configfs.c:1750
 configfs_symlink+0x5ec/0xfb4 fs/configfs/symlink.c:211
 vfs_symlink+0x16c/0x290 fs/namei.c:5794
 filename_symlinkat+0x18c/0x328 fs/namei.c:5819
 __do_sys_symlinkat fs/namei.c:5839 [inline]
 __se_sys_symlinkat fs/namei.c:5834 [inline]
 __arm64_sys_symlinkat+0xb0/0xdc fs/namei.c:5834
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
configfs: configfs_get_target_path: depth = 7, size = 79
configfs: configfs_get_target_path: path = '../../../../../../../usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u'
kcov: kcov_task_exit: t = ffff0000d7c80000, kcov->t = ffff0000d7c80000