Warning: Permanently added '10.128.1.94' (ED25519) to the list of known hosts.
[+] Starting reproducer for configfs_depend_item_unlocked GPF...
[+] Directory /sys/kernel/config ready.
[+] configfs is already mounted on /sys/kernel/config.
[+] mkdir /sys/kernel/config/usb_gadget/g1 successful.
[+] mkdir /sys/kernel/config/usb_gadget/g1/functions/tcm.usb0 successful.
[+] mkdir /sys/kernel/config/target/usb_gadget successful.
[+] mkdir /sys/kernel/config/target/usb_gadget/naa.5001405000000000 successful.
[+] rmdir /sys/kernel/config/usb_gadget/g1/functions/tcm.usb0 successful, setup complete.
[+] Detected 2 online CPUs.
[+] Created gadget worker thread pinned to CPU 0.
[+] Created target worker thread 0 pinned to CPU 1.
[+] Racing started. Triggering race between gadget function and target TPG...
[  111.197258][ T6006] 
[  111.199629][ T6006] ======================================================
[  111.206654][ T6006] WARNING: possible circular locking dependency detected
[  111.213738][ T6006] syzkaller #0 Not tainted
[  111.218154][ T6006] ------------------------------------------------------
[  111.225165][ T6006] syz-executor576/6006 is trying to acquire lock:
[  111.231553][ T6006] ffff888024880f80 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420
[  111.243034][ T6006] 
[  111.243034][ T6006] but task is already holding lock:
[  111.250372][ T6006] ffffffff90c72080 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550
[  111.259584][ T6006] 
[  111.259584][ T6006] which lock already depends on the new lock.
[  111.259584][ T6006] 
[  111.269963][ T6006] 
[  111.269963][ T6006] the existing dependency chain (in reverse order) is:
[  111.278987][ T6006] 
[  111.278987][ T6006] -> #1 (tpg_instances_lock){+.+.}-{4:4}:
[  111.286876][ T6006]        __mutex_lock+0x19d/0x1550
[  111.291999][ T6006]        tcm_free_inst+0x1b/0x50
[  111.296923][ T6006]        usb_put_function_instance+0x95/0xc0
[  111.302889][ T6006]        config_item_release+0x13a/0x2d0
[  111.308513][ T6006]        configfs_rmdir+0x885/0x950
[  111.313696][ T6006]        vfs_rmdir+0x3e6/0x6a0
[  111.318443][ T6006]        filename_rmdir+0x292/0x520
[  111.323624][ T6006]        __se_sys_rmdir+0x2e/0x140
[  111.328723][ T6006]        do_syscall_64+0x166/0x520
[  111.333816][ T6006]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.340210][ T6006] 
[  111.340210][ T6006] -> #0 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}:
[  111.348893][ T6006]        __lock_acquire+0x164c/0x2de0
[  111.354250][ T6006]        lock_acquire+0x115/0x350
[  111.359255][ T6006]        down_write+0x96/0x200
[  111.364005][ T6006]        configfs_depend_item_unlocked+0x153/0x420
[  111.370492][ T6006]        usbg_make_tpg+0x1e0/0x550
[  111.375607][ T6006]        target_fabric_make_tpg+0xa8/0x6d0
[  111.381395][ T6006]        configfs_mkdir+0x4f6/0x9e0
[  111.386577][ T6006]        vfs_mkdir+0x40c/0x620
[  111.391326][ T6006]        filename_mkdirat+0x285/0x510
[  111.396712][ T6006]        __se_sys_mkdir+0x34/0x150
[  111.401807][ T6006]        do_syscall_64+0x166/0x520
[  111.406906][ T6006]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.413305][ T6006] 
[  111.413305][ T6006] other info that might help us debug this:
[  111.413305][ T6006] 
[  111.423510][ T6006]  Possible unsafe locking scenario:
[  111.423510][ T6006] 
[  111.430954][ T6006]        CPU0                    CPU1
[  111.436295][ T6006]        ----                    ----
[  111.441634][ T6006]   lock(tpg_instances_lock);
[  111.446326][ T6006]                                lock(&sb->s_type->i_mutex_key#25);
[  111.454293][ T6006]                                lock(tpg_instances_lock);
[  111.461576][ T6006]   lock(&sb->s_type->i_mutex_key#25);
[  111.467024][ T6006] 
[  111.467024][ T6006]  *** DEADLOCK ***
[  111.467024][ T6006] 
[  111.475143][ T6006] locks held by syz-executor576/6006: 4, last CPU#1:
[  111.481792][ T6006]  #0: ffff88801e7ca460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90
[  111.491019][ T6006]  #1: ffff88803531c140 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370
[  111.501815][ T6006]  #2: ffffffff9093c7c8 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0
[  111.511558][ T6006]  #3: ffffffff90c72080 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf8/0x550
[  111.521220][ T6006] 
[  111.521220][ T6006] stack backtrace:
[  111.527179][ T6006] CPU: 1 UID: 0 PID: 6006 Comm: syz-executor576 Not tainted syzkaller #0 PREEMPT(full) 
[  111.536877][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  111.546909][ T6006] Call Trace:
[  111.550173][ T6006]  <TASK>
[  111.553083][ T6006]  dump_stack_lvl+0xe8/0x150
[  111.557665][ T6006]  print_circular_bug+0x2e2/0x300
[  111.562702][ T6006]  check_noncircular+0x12f/0x150
[  111.567631][ T6006]  __lock_acquire+0x164c/0x2de0
[  111.572470][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.578194][ T6006]  ? __mutex_trylock_common+0x15f/0x270
[  111.583736][ T6006]  ? __pfx___mutex_trylock_common+0x10/0x10
[  111.589636][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.595254][ T6006]  ? rcu_is_watching+0x16/0xb0
[  111.600007][ T6006]  lock_acquire+0x115/0x350
[  111.604495][ T6006]  ? configfs_depend_item_unlocked+0x153/0x420
[  111.610640][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.616260][ T6006]  down_write+0x96/0x200
[  111.620495][ T6006]  ? configfs_depend_item_unlocked+0x153/0x420
[  111.626660][ T6006]  ? __pfx_down_write+0x10/0x10
[  111.631503][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.637121][ T6006]  ? kstrtoull+0x137/0x1d0
[  111.641527][ T6006]  configfs_depend_item_unlocked+0x153/0x420
[  111.647507][ T6006]  usbg_make_tpg+0x1e0/0x550
[  111.652084][ T6006]  ? configfs_mkdir+0x4b0/0x9e0
[  111.656923][ T6006]  ? __pfx___mutex_lock+0x10/0x10
[  111.661938][ T6006]  ? __pfx_usbg_make_tpg+0x10/0x10
[  111.667038][ T6006]  ? do_raw_spin_lock+0x12b/0x2f0
[  111.672059][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.677677][ T6006]  target_fabric_make_tpg+0xa8/0x6d0
[  111.682990][ T6006]  configfs_mkdir+0x4f6/0x9e0
[  111.687659][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.693277][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.698906][ T6006]  ? __pfx_configfs_mkdir+0x10/0x10
[  111.704133][ T6006]  ? generic_permission+0x2bf/0x670
[  111.709343][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.714978][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.720595][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.726242][ T6006]  vfs_mkdir+0x40c/0x620
[  111.730476][ T6006]  filename_mkdirat+0x285/0x510
[  111.735337][ T6006]  ? __pfx_filename_mkdirat+0x10/0x10
[  111.740695][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.746310][ T6006]  ? do_getname+0x151/0x250
[  111.750806][ T6006]  __se_sys_mkdir+0x34/0x150
[  111.755414][ T6006]  do_syscall_64+0x166/0x520
[  111.759991][ T6006]  ? trace_irq_disable+0x3b/0x140
[  111.765000][ T6006]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.771050][ T6006]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.776921][ T6006] RIP: 0033:0x7f49bcbd23c7
[  111.781318][ T6006] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8
[  111.800903][ T6006] RSP: 002b:00007f49bc39c188 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
[  111.809301][ T6006] RAX: ffffffffffffffda RBX: 00007f49bcc414b0 RCX: 00007f49bcbd23c7
[  111.817257][ T6006] RDX: ffffffffffffffd0 RSI: 00000000000001ff RDI: 00007f49bcc414b0
[  111.825209][ T6006] RBP: 0000000000000021 R08: 0000000000000000 R09: 00007f49bc39c6c0
[  111.833167][ T6006] R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffd0
[  111.841118][ T6006] R13: 0000000000000010 R14: 00007ffc6127cbd0 R15: 00007ffc6127ccb8
[  111.849096][ T6006]  </TASK>
[  111.853519][ T6006] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
[  111.865582][ T6006] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
[  111.873992][ T6006] CPU: 1 UID: 0 PID: 6006 Comm: syz-executor576 Not tainted syzkaller #0 PREEMPT(full) 
[  111.883707][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  111.893744][ T6006] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420
[  111.900413][ T6006] Code: df e8 ae 89 00 00 89 c5 31 ff 89 c6 e8 63 e9 4b ff 85 ed 74 0a e8 5a e4 4b ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 7e c1 bc ff 4c 8b 6b 60 48 89 df e8 72 89
[  111.920003][ T6006] RSP: 0018:ffffc90003fafad8 EFLAGS: 00010216
[  111.926142][ T6006] RAX: 000000000000000c RBX: 0000000000000000 RCX: ffff88802ad95dc0
[  111.934120][ T6006] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000060
[  111.942072][ T6006] RBP: 0000000000000000 R08: ffffffff917a747f R09: 1ffffffff22f4e8f
[  111.950023][ T6006] R10: dffffc0000000000 R11: fffffbfff22f4e90 R12: ffffffff9093c6e0
[  111.957981][ T6006] R13: 1ffff920007f5f6c R14: dffffc0000000000 R15: ffff88802958bc00
[  111.965952][ T6006] FS:  00007f49bc39c6c0(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000
[  111.974879][ T6006] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  111.981450][ T6006] CR2: 00007f49bcba512d CR3: 00000000729ed000 CR4: 0000000000350ef0
[  111.989409][ T6006] Call Trace:
[  111.992674][ T6006]  <TASK>
[  111.995604][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.001236][ T6006]  usbg_make_tpg+0x1e0/0x550
[  112.005819][ T6006]  ? configfs_mkdir+0x4b0/0x9e0
[  112.010670][ T6006]  ? __pfx___mutex_lock+0x10/0x10
[  112.015693][ T6006]  ? __pfx_usbg_make_tpg+0x10/0x10
[  112.020798][ T6006]  ? do_raw_spin_lock+0x12b/0x2f0
[  112.025825][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.031454][ T6006]  target_fabric_make_tpg+0xa8/0x6d0
[  112.036737][ T6006]  configfs_mkdir+0x4f6/0x9e0
[  112.041412][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.047039][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.052666][ T6006]  ? __pfx_configfs_mkdir+0x10/0x10
[  112.057858][ T6006]  ? generic_permission+0x2bf/0x670
[  112.063060][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.068685][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.074312][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.079939][ T6006]  vfs_mkdir+0x40c/0x620
[  112.084178][ T6006]  filename_mkdirat+0x285/0x510
[  112.089028][ T6006]  ? __might_fault+0xcb/0x130
[  112.093696][ T6006]  ? __pfx_filename_mkdirat+0x10/0x10
[  112.099073][ T6006]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.104697][ T6006]  ? do_getname+0x151/0x250
[  112.109200][ T6006]  __se_sys_mkdir+0x34/0x150
[  112.113789][ T6006]  do_syscall_64+0x166/0x520
[  112.118392][ T6006]  ? trace_irq_disable+0x3b/0x140
[  112.123407][ T6006]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.129502][ T6006]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.135382][ T6006] RIP: 0033:0x7f49bcbd23c7
[  112.139785][ T6006] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8
[  112.159375][ T6006] RSP: 002b:00007f49bc39c188 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
[  112.167780][ T6006] RAX: ffffffffffffffda RBX: 00007f49bcc414b0 RCX: 00007f49bcbd23c7
[  112.175739][ T6006] RDX: ffffffffffffffd0 RSI: 00000000000001ff RDI: 00007f49bcc414b0
[  112.183695][ T6006] RBP: 0000000000000021 R08: 0000000000000000 R09: 00007f49bc39c6c0
[  112.191651][ T6006] R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffd0
[  112.199605][ T6006] R13: 0000000000000010 R14: 00007ffc6127cbd0 R15: 00007ffc6127ccb8
[  112.207574][ T6006]  </TASK>
[  112.210624][ T6006] Modules linked in:
[  112.214622][ T6006] ---[ end trace 0000000000000000 ]---
[  112.221994][ T6006] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420
[  112.222038][ T6006] Code: df e8 ae 89 00 00 89 c5 31 ff 89 c6 e8 63 e9 4b ff 85 ed 74 0a e8 5a e4 4b ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 7e c1 bc ff 4c 8b 6b 60 48 89 df e8 72 89
[  112.222058][ T6006] RSP: 0018:ffffc90003fafad8 EFLAGS: 00010216
[  112.222081][ T6006] RAX: 000000000000000c RBX: 0000000000000000 RCX: ffff88802ad95dc0
[  112.222098][ T6006] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000060
[  112.222114][ T6006] RBP: 0000000000000000 R08: ffffffff917a747f R09: 1ffffffff22f4e8f
[  112.222132][ T6006] R10: dffffc0000000000 R11: fffffbfff22f4e90 R12: ffffffff9093c6e0
[  112.222151][ T6006] R13: 1ffff920007f5f6c R14: dffffc0000000000 R15: ffff88802958bc00
[  112.222174][ T6006] FS:  00007f49bc39c6c0(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000
[  112.222196][ T6006] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  112.222214][ T6006] CR2: 00007f49bcba512d CR3: 00000000729ed000 CR4: 0000000000350ef0
[  112.222244][ T6006] Kernel panic - not syncing: Fatal exception
[  112.323846][ T6006] Kernel Offset: disabled
[  112.328156][ T6006] Rebooting in 86400 seconds..