Warning: Permanently added '10.128.0.79' (ED25519) to the list of known hosts. [ 118.755456][ T6025] [ 118.757846][ T6025] ====================================================== [ 118.764853][ T6025] WARNING: possible circular locking dependency detected [ 118.771861][ T6025] syzkaller #0 Not tainted [ 118.776267][ T6025] ------------------------------------------------------ [ 118.783278][ T6025] syz-executor345/6025 is trying to acquire lock: [ 118.789686][ T6025] ffff8880238f3580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 118.801208][ T6025] [ 118.801208][ T6025] but task is already holding lock: [ 118.808563][ T6025] ffffffff8fc70fa0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 118.817826][ T6025] [ 118.817826][ T6025] which lock already depends on the new lock. [ 118.817826][ T6025] [ 118.828212][ T6025] [ 118.828212][ T6025] the existing dependency chain (in reverse order) is: [ 118.837300][ T6025] [ 118.837300][ T6025] -> #3 (tpg_instances_lock){+.+.}-{4:4}: [ 118.845294][ T6025] __mutex_lock+0x19d/0x1550 [ 118.850420][ T6025] tcm_alloc_inst+0x65/0x1a0 [ 118.855523][ T6025] usb_get_function_instance+0xe3/0x2f0 [ 118.861605][ T6025] function_make+0x127/0x360 [ 118.866730][ T6025] configfs_mkdir+0x4f6/0x9e0 [ 118.872018][ T6025] vfs_mkdir+0x40c/0x620 [ 118.876783][ T6025] filename_mkdirat+0x285/0x510 [ 118.882149][ T6025] __se_sys_mkdir+0x34/0x150 [ 118.887257][ T6025] do_syscall_64+0x166/0x520 [ 118.892397][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.898804][ T6025] [ 118.898804][ T6025] -> #2 (func_lock){+.+.}-{4:4}: [ 118.905932][ T6025] __mutex_lock+0x19d/0x1550 [ 118.911046][ T6025] usb_get_function_instance+0x2e/0x2f0 [ 118.917119][ T6025] function_make+0x127/0x360 [ 118.922223][ T6025] configfs_mkdir+0x4f6/0x9e0 [ 118.927416][ T6025] vfs_mkdir+0x40c/0x620 [ 118.932171][ T6025] filename_mkdirat+0x285/0x510 [ 118.937539][ T6025] __se_sys_mkdir+0x34/0x150 [ 118.942643][ T6025] do_syscall_64+0x166/0x520 [ 118.947755][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.954161][ T6025] [ 118.954161][ T6025] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 118.962450][ T6025] __mutex_lock+0x19d/0x1550 [ 118.967583][ T6025] configfs_rmdir+0x5f0/0x950 [ 118.972791][ T6025] vfs_rmdir+0x3e6/0x6a0 [ 118.977571][ T6025] filename_rmdir+0x292/0x520 [ 118.982772][ T6025] __se_sys_rmdir+0x2e/0x140 [ 118.987884][ T6025] do_syscall_64+0x166/0x520 [ 118.993001][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.999408][ T6025] [ 118.999408][ T6025] -> #0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 119.008104][ T6025] __lock_acquire+0x164c/0x2de0 [ 119.013475][ T6025] lock_acquire+0x115/0x350 [ 119.018490][ T6025] down_write+0x96/0x200 [ 119.023256][ T6025] configfs_depend_item_unlocked+0x153/0x420 [ 119.029775][ T6025] usbg_make_tpg+0x1e0/0x550 [ 119.034891][ T6025] target_fabric_make_tpg+0xa8/0x6d0 [ 119.040690][ T6025] configfs_mkdir+0x4f6/0x9e0 [ 119.045881][ T6025] vfs_mkdir+0x40c/0x620 [ 119.050634][ T6025] filename_mkdirat+0x285/0x510 [ 119.055998][ T6025] __se_sys_mkdir+0x34/0x150 [ 119.061102][ T6025] do_syscall_64+0x166/0x520 [ 119.066213][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.072619][ T6025] [ 119.072619][ T6025] other info that might help us debug this: [ 119.072619][ T6025] [ 119.082919][ T6025] Chain exists of: [ 119.082919][ T6025] &sb->s_type->i_mutex_key#24 --> func_lock --> tpg_instances_lock [ 119.082919][ T6025] [ 119.096749][ T6025] Possible unsafe locking scenario: [ 119.096749][ T6025] [ 119.104182][ T6025] CPU0 CPU1 [ 119.109536][ T6025] ---- ---- [ 119.114884][ T6025] lock(tpg_instances_lock); [ 119.119553][ T6025] lock(func_lock); [ 119.125957][ T6025] lock(tpg_instances_lock); [ 119.133144][ T6025] lock(&sb->s_type->i_mutex_key#24); [ 119.138614][ T6025] [ 119.138614][ T6025] *** DEADLOCK *** [ 119.138614][ T6025] [ 119.146738][ T6025] locks held by syz-executor345/6025: 4, last CPU#0: [ 119.153425][ T6025] #0: ffff88801d710460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 119.162671][ T6025] #1: ffff88806e9c1dc0 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 119.173491][ T6025] #2: ffffffff8f93b768 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 119.183343][ T6025] #3: ffffffff8fc70fa0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550 [ 119.193114][ T6025] [ 119.193114][ T6025] stack backtrace: [ 119.198993][ T6025] CPU: 0 UID: 0 PID: 6025 Comm: syz-executor345 Not tainted syzkaller #0 PREEMPT(full) [ 119.208782][ T6025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.218824][ T6025] Call Trace: [ 119.222097][ T6025] [ 119.225015][ T6025] dump_stack_lvl+0xe8/0x150 [ 119.229612][ T6025] print_circular_bug+0x2e2/0x300 [ 119.234641][ T6025] check_noncircular+0x12f/0x150 [ 119.239596][ T6025] __lock_acquire+0x164c/0x2de0 [ 119.244447][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.250077][ T6025] ? __mutex_trylock_common+0x15f/0x270 [ 119.255631][ T6025] ? __pfx___mutex_trylock_common+0x10/0x10 [ 119.261528][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.267154][ T6025] ? rcu_is_watching+0x16/0xb0 [ 119.271920][ T6025] lock_acquire+0x115/0x350 [ 119.276416][ T6025] ? configfs_depend_item_unlocked+0x153/0x420 [ 119.282575][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.288294][ T6025] down_write+0x96/0x200 [ 119.292585][ T6025] ? configfs_depend_item_unlocked+0x153/0x420 [ 119.298736][ T6025] ? __pfx_down_write+0x10/0x10 [ 119.303595][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.309222][ T6025] ? kstrtoull+0x137/0x1d0 [ 119.313635][ T6025] configfs_depend_item_unlocked+0x153/0x420 [ 119.319617][ T6025] usbg_make_tpg+0x1e0/0x550 [ 119.324214][ T6025] ? configfs_mkdir+0x4b0/0x9e0 [ 119.329063][ T6025] ? __pfx___mutex_lock+0x10/0x10 [ 119.334091][ T6025] ? __pfx_usbg_make_tpg+0x10/0x10 [ 119.339206][ T6025] ? do_raw_spin_lock+0x12b/0x2f0 [ 119.344237][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.349869][ T6025] target_fabric_make_tpg+0xa8/0x6d0 [ 119.355242][ T6025] configfs_mkdir+0x4f6/0x9e0 [ 119.359918][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.365546][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.371262][ T6025] ? __pfx_configfs_mkdir+0x10/0x10 [ 119.376456][ T6025] ? generic_permission+0x2bf/0x670 [ 119.381658][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.387285][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.392931][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.398560][ T6025] vfs_mkdir+0x40c/0x620 [ 119.402832][ T6025] filename_mkdirat+0x285/0x510 [ 119.407683][ T6025] ? __pfx_filename_mkdirat+0x10/0x10 [ 119.413050][ T6025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.418680][ T6025] ? do_getname+0x151/0x250 [ 119.423184][ T6025] __se_sys_mkdir+0x34/0x150 [ 119.427770][ T6025] do_syscall_64+0x166/0x520 [ 119.432365][ T6025] ? trace_irq_disable+0x3b/0x140 [ 119.437385][ T6025] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.443456][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.449341][ T6025] RIP: 0033:0x7f860f844fb7 [ 119.453746][ T6025] Code: 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 119.473342][ T6025] RSP: 002b:00007ffdb3014a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 119.481749][ T6025] RAX: ffffffffffffffda RBX: 00007ffdb3014a50 RCX: 00007f860f844fb7 [ 119.489711][ T6025] RDX: ffffffffffffffd8 RSI: 00000000000001ff RDI: 00007ffdb3014a10 [ 119.497676][ T6025] RBP: 00007ffdb3014a10 R08: 00007ffdb3014b10 R09: 00000000ffffffff [ 119.505638][ T6025] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdb3014c48 [ 119.513597][ T6025] R13: 0000000000000002 R14: 00007f860f8c8cc0 R15: 0000000000000002 [ 119.521568][ T6025] [*] Starting reproducer... [*] Creating UVC uncompressed format directory... [+] mkdir(/sys/kernel/config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u1) successful or already exists. [*] Removing UVC uncompressed format directory... [+] rmdir successful. [*] Recreating UVC uncompressed format directory... [+] mkdir(/sys/kernel/config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u1) successful or already exists. [*] Writing to bmaControls... [+] Write to bmaControls successful. [*] Creating TCM function... [+] mkdir(/sys/kernel/config/usb_gadget/g1/functions/tcm.0) successful or already exists. [*] Creating TCM TPG... [+] mkdir(/sys/kernel/config/target/usb_gadget/naa.1234567890123456/tpgt_1) successful or already exists. [+] Reproducer finished.