[ 70.988235][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.988298][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '[localhost]:35189' (ED25519) to the list of known hosts. [*] Starting reproducer for circular locking dependency in uvcg_default_processing_bm_controls_show... [+] mkdir /sys/kernel/config successful. [+] mount configfs successful. [+] mkdir /sys/kernel/config/usb_gadget/g1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/tcm.0 successful. [+] mkdir /sys/kernel/config/target/usb_gadget successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.5001405fc7642d66 successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.5001405fc7642d66/tpgt_1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0 successful. [*] rmdir /sys/kernel/config/usb_gadget/g1 returned: Directory not empty (expected ENOTEMPTY) [*] Trying independent subsystem at /sys/kernel/config/thunderbolt/repro_dummy... [*] Trying independent subsystem at /sys/kernel/config/dlm/repro_dummy... [+] Created /sys/kernel/config/dlm/repro_dummy [+] Successfully removed /sys/kernel/config/dlm/repro_dummy (established inode_lock -> frag_sem) [+] open /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/processing/default/bmControls successful. [ 72.775693][ T6013] [ 72.776860][ T6013] ====================================================== [ 72.779741][ T6013] WARNING: possible circular locking dependency detected [ 72.782490][ T6013] syzkaller #0 Not tainted [ 72.783902][ T6013] ------------------------------------------------------ [ 72.786076][ T6013] syz-executor434/6013 is trying to acquire lock: [ 72.788107][ T6013] ffffffff91402ce8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.791833][ T6013] [ 72.791833][ T6013] but task is already holding lock: [ 72.794156][ T6013] ffff888000c93470 (&p->frag_sem){++++}-{4:4}, at: configfs_read_iter+0x346/0x6f0 [ 72.797077][ T6013] [ 72.797077][ T6013] which lock already depends on the new lock. [ 72.797077][ T6013] [ 72.800311][ T6013] [ 72.800311][ T6013] the existing dependency chain (in reverse order) is: [ 72.803123][ T6013] [ 72.803123][ T6013] -> #4 (&p->frag_sem){++++}-{4:4}: [ 72.805486][ T6013] lock_acquire+0x1d1/0x380 [ 72.807117][ T6013] down_write_killable+0x93/0x240 [ 72.808880][ T6013] configfs_rmdir+0x3fa/0x950 [ 72.810550][ T6013] vfs_rmdir+0x328/0x8a0 [ 72.812068][ T6013] filename_rmdir+0x31a/0x5c0 [ 72.813744][ T6013] __ia32_sys_rmdir+0x45/0x60 [ 72.815413][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 72.817298][ T6013] do_fast_syscall_32+0x32/0x70 [ 72.819005][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.821231][ T6013] [ 72.821231][ T6013] -> #3 (&sb->s_type->i_mutex_key#25){++++}-{4:4}: [ 72.823950][ T6013] lock_acquire+0x1d1/0x380 [ 72.825560][ T6013] down_write+0x8b/0x1f0 [ 72.827098][ T6013] configfs_depend_item_unlocked+0xf3/0x6a0 [ 72.829116][ T6013] usbg_make_tpg+0x251/0x610 [ 72.830744][ T6013] target_fabric_make_tpg+0xab/0x8c0 [ 72.832596][ T6013] configfs_mkdir+0x525/0xd40 [ 72.834252][ T6013] vfs_mkdir+0x364/0x850 [ 72.835785][ T6013] filename_mkdirat+0x48b/0x5e0 [ 72.837500][ T6013] __ia32_sys_mkdir+0x6a/0x90 [ 72.839144][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 72.840964][ T6013] do_fast_syscall_32+0x32/0x70 [ 72.842660][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.844831][ T6013] [ 72.844831][ T6013] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 72.847544][ T6013] lock_acquire+0x1d1/0x380 [ 72.849292][ T6013] __mutex_lock+0x1a4/0x1bd0 [ 72.851111][ T6013] tcm_alloc_inst+0x5f/0x1e0 [ 72.853032][ T6013] try_get_usb_function_instance+0x136/0x1f0 [ 72.855242][ T6013] usb_get_function_instance+0x16/0x70 [ 72.857188][ T6013] function_make+0x18c/0x3f0 [ 72.858826][ T6013] configfs_mkdir+0x525/0xd40 [ 72.860506][ T6013] vfs_mkdir+0x364/0x850 [ 72.862039][ T6013] filename_mkdirat+0x48b/0x5e0 [ 72.863761][ T6013] __ia32_sys_mkdir+0x6a/0x90 [ 72.865690][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 72.868089][ T6013] do_fast_syscall_32+0x32/0x70 [ 72.870389][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.873263][ T6013] [ 72.873263][ T6013] -> #1 (func_lock){+.+.}-{4:4}: [ 72.875836][ T6013] lock_acquire+0x1d1/0x380 [ 72.877775][ T6013] __mutex_lock+0x1a4/0x1bd0 [ 72.879676][ T6013] try_get_usb_function_instance+0x26/0x1f0 [ 72.882019][ T6013] usb_get_function_instance+0x16/0x70 [ 72.884310][ T6013] function_make+0x18c/0x3f0 [ 72.886444][ T6013] configfs_mkdir+0x525/0xd40 [ 72.888559][ T6013] vfs_mkdir+0x364/0x850 [ 72.890592][ T6013] filename_mkdirat+0x48b/0x5e0 [ 72.892819][ T6013] __ia32_sys_mkdir+0x6a/0x90 [ 72.895079][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 72.897468][ T6013] do_fast_syscall_32+0x32/0x70 [ 72.899675][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.902537][ T6013] [ 72.902537][ T6013] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 72.905953][ T6013] check_prev_add+0xeb/0xe60 [ 72.908142][ T6013] __lock_acquire+0x1528/0x1f40 [ 72.910406][ T6013] lock_acquire+0x1d1/0x380 [ 72.912580][ T6013] __mutex_lock+0x1a4/0x1bd0 [ 72.914545][ T6013] uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.917098][ T6013] configfs_read_iter+0x426/0x6f0 [ 72.918909][ T6013] vfs_read+0x82e/0xb40 [ 72.920411][ T6013] ksys_read+0x12a/0x250 [ 72.921947][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 72.923747][ T6013] do_fast_syscall_32+0x32/0x70 [ 72.925454][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.927604][ T6013] [ 72.927604][ T6013] other info that might help us debug this: [ 72.927604][ T6013] [ 72.930750][ T6013] Chain exists of: [ 72.930750][ T6013] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#25 --> &p->frag_sem [ 72.930750][ T6013] [ 72.935190][ T6013] Possible unsafe locking scenario: [ 72.935190][ T6013] [ 72.937529][ T6013] CPU0 CPU1 [ 72.939599][ T6013] ---- ---- [ 72.941826][ T6013] rlock(&p->frag_sem); [ 72.943596][ T6013] lock(&sb->s_type->i_mutex_key#25); [ 72.946102][ T6013] lock(&p->frag_sem); [ 72.948212][ T6013] lock(gadget_subsys.su_mutex); [ 72.949812][ T6013] [ 72.949812][ T6013] *** DEADLOCK *** [ 72.949812][ T6013] [ 72.952364][ T6013] locks held by syz-executor434/6013: 2, last CPU#1: [ 72.954469][ T6013] #0: ffff8880500c0280 (&buffer->mutex){+.+.}-{4:4}, at: configfs_read_iter+0x79/0x6f0 [ 72.957548][ T6013] #1: ffff888000c93470 (&p->frag_sem){++++}-{4:4}, at: configfs_read_iter+0x346/0x6f0 [ 72.960813][ T6013] [ 72.960813][ T6013] stack backtrace: [ 72.963179][ T6013] CPU: 1 UID: 0 PID: 6013 Comm: syz-executor434 Not tainted syzkaller #0 PREEMPT(full) [ 72.966232][ T6013] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.969399][ T6013] Call Trace: [ 72.970467][ T6013] [ 72.971413][ T6013] dump_stack_lvl+0x100/0x190 [ 72.972938][ T6013] print_circular_bug.cold+0x178/0x1be [ 72.974672][ T6013] check_noncircular+0x146/0x160 [ 72.976273][ T6013] check_prev_add+0xeb/0xe60 [ 72.977805][ T6013] __lock_acquire+0x1528/0x1f40 [ 72.979362][ T6013] lock_acquire+0x1d1/0x380 [ 72.980821][ T6013] ? uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.983007][ T6013] ? __pfx___might_resched+0x10/0x10 [ 72.984677][ T6013] ? check_prev_add+0x354/0xe60 [ 72.986373][ T6013] __mutex_lock+0x1a4/0x1bd0 [ 72.987878][ T6013] ? uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.990063][ T6013] ? uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.992235][ T6013] ? __pfx___mutex_lock+0x10/0x10 [ 72.993840][ T6013] ? lock_acquire+0x1d1/0x380 [ 72.995349][ T6013] ? __pfx_uvcg_default_processing_bm_controls_show+0x10/0x10 [ 72.997701][ T6013] ? uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 72.999867][ T6013] uvcg_default_processing_bm_controls_show+0x57/0x2a0 [ 73.002005][ T6013] ? configfs_read_iter+0x53c/0x6f0 [ 73.003644][ T6013] ? __pfx_uvcg_default_processing_bm_controls_show+0x10/0x10 [ 73.005998][ T6013] configfs_read_iter+0x426/0x6f0 [ 73.007750][ T6013] ? __pfx_configfs_read_iter+0x10/0x10 [ 73.009518][ T6013] vfs_read+0x82e/0xb40 [ 73.010836][ T6013] ? __pfx_vfs_read+0x10/0x10 [ 73.012339][ T6013] ? __pfx_do_sys_openat2+0x10/0x10 [ 73.013993][ T6013] ksys_read+0x12a/0x250 [ 73.015362][ T6013] ? __pfx_ksys_read+0x10/0x10 [ 73.017051][ T6013] __do_fast_syscall_32+0x13a/0x8b0 [ 73.018693][ T6013] ? lockdep_hardirqs_on+0x7d/0x110 [ 73.020329][ T6013] do_fast_syscall_32+0x32/0x70 [ 73.021877][ T6013] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 73.023865][ T6013] RIP: 0023:0xf7ee5fec [ 73.025564][ T6013] Code: Unable to access opcode bytes at 0xf7ee5fc2. [ 73.028316][ T6013] RSP: 002b:00000000ff9e98b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 73.031718][ T6013] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000ff9e9970 [ 73.034983][ T6013] RDX: 00000000000000ff RSI: 0000000000000000 RDI: 0000000000000000 [ 73.038230][ T6013] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 73.041473][ T6013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.044710][ T6013] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 73.047261][ T6013] [+] read 4 bytes from /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/processing/default/bmControls: 1 0 [+] close /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/processing/default/bmControls successful. [+] Reproduction sequence completed successfully. [ 76.104510][ T1037] cfg80211: failed to load regulatory.db