Warning: Permanently added '10.128.0.17' (ED25519) to the list of known hosts. [*] Starting reproducer for circular locking dependency in uvcg_extension_bm_controls_store [+] /sys/kernel/config exists. [+] configfs is already mounted at /sys/kernel/config. [*] [Initial] lockdep debug_locks status: 1 [*] Attempting to establish Edge #3 via an independent configfs subsystem... [-] /sys/kernel/config/nullb not available or failed: File exists. Trying netconsole... [-] /sys/kernel/config/netconsole not available or failed: No such file or directory. Scanning /sys/kernel/config... [*] Trying mkdir /sys/kernel/config/thunderbolt/repro_leaf [*] Trying mkdir /sys/kernel/config/dlm/repro_leaf [+] mkdir /sys/kernel/config/dlm/repro_leaf successful. [+] rmdir /sys/kernel/config/dlm/repro_leaf successful (Edge #3 established via dlm). [*] [After Edge #3] lockdep debug_locks status: 1 [+] mkdir /sys/kernel/config/usb_gadget/g1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/tcm.usb0 successful (Edge #1 established). [*] [After Edge #1] lockdep debug_locks status: 1 [+] mkdir /sys/kernel/config/target/usb_gadget successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.1234567890123456 successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.1234567890123456/tpgt_1 successful (Edge #2 established). [*] [After Edge #2] lockdep debug_locks status: 1 [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.usb0 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0 successful. [ 110.661545][ T5998] [ 110.663908][ T5998] ====================================================== [ 110.670913][ T5998] WARNING: possible circular locking dependency detected [ 110.677919][ T5998] syzkaller #0 Not tainted [ 110.682328][ T5998] ------------------------------------------------------ [ 110.689339][ T5998] syz-executor184/5998 is trying to acquire lock: [ 110.695743][ T5998] ffffffff90c14b28 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_extension_bm_controls_store+0xe4/0xb00 [ 110.706982][ T5998] [ 110.706982][ T5998] but task is already holding lock: [ 110.714340][ T5998] ffff888028accd70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 110.723666][ T5998] [ 110.723666][ T5998] which lock already depends on the new lock. [ 110.723666][ T5998] [ 110.734062][ T5998] [ 110.734062][ T5998] the existing dependency chain (in reverse order) is: [ 110.743063][ T5998] [ 110.743063][ T5998] -> #4 (&p->frag_sem){++++}-{4:4}: [ 110.750454][ T5998] down_write_killable+0xa6/0x240 [ 110.756001][ T5998] configfs_rmdir+0x3b0/0x950 [+] open /sys/kernel/config/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0/bmControls successful. [ 110.761205][ T5998] vfs_rmdir+0x3e6/0x6a0 [ 110.765965][ T5998] filename_rmdir+0x292/0x520 [ 110.771158][ T5998] __se_sys_rmdir+0x2e/0x140 [ 110.776263][ T5998] do_syscall_64+0x166/0x520 [ 110.781371][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.787774][ T5998] [ 110.787774][ T5998] -> #3 (&sb->s_type->i_mutex_key#25){++++}-{4:4}: [ 110.796467][ T5998] down_write+0x96/0x200 [ 110.801224][ T5998] configfs_depend_item_unlocked+0x153/0x420 [ 110.807720][ T5998] usbg_make_tpg+0x1e0/0x550 [ 110.812823][ T5998] target_fabric_make_tpg+0xa8/0x6d0 [ 110.818619][ T5998] configfs_mkdir+0x4f6/0x9e0 [ 110.823814][ T5998] vfs_mkdir+0x40c/0x620 [ 110.828575][ T5998] filename_mkdirat+0x285/0x510 [ 110.833939][ T5998] __se_sys_mkdir+0x34/0x150 [ 110.839041][ T5998] do_syscall_64+0x166/0x520 [ 110.844142][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.850542][ T5998] [ 110.850542][ T5998] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 110.858440][ T5998] __mutex_lock+0x19d/0x1550 [ 110.863543][ T5998] tcm_alloc_inst+0x65/0x1a0 [ 110.868645][ T5998] usb_get_function_instance+0xe3/0x2f0 [ 110.874702][ T5998] function_make+0x127/0x360 [ 110.879808][ T5998] configfs_mkdir+0x4f6/0x9e0 [ 110.885002][ T5998] vfs_mkdir+0x40c/0x620 [ 110.889797][ T5998] filename_mkdirat+0x285/0x510 [ 110.895158][ T5998] __se_sys_mkdir+0x34/0x150 [ 110.900259][ T5998] do_syscall_64+0x166/0x520 [ 110.905359][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.911758][ T5998] [ 110.911758][ T5998] -> #1 (func_lock){+.+.}-{4:4}: [ 110.918879][ T5998] __mutex_lock+0x19d/0x1550 [ 110.923987][ T5998] usb_get_function_instance+0x2e/0x2f0 [ 110.930046][ T5998] function_make+0x127/0x360 [ 110.935156][ T5998] configfs_mkdir+0x4f6/0x9e0 [ 110.940348][ T5998] vfs_mkdir+0x40c/0x620 [ 110.945102][ T5998] filename_mkdirat+0x285/0x510 [ 110.950469][ T5998] __se_sys_mkdir+0x34/0x150 [ 110.955568][ T5998] do_syscall_64+0x166/0x520 [ 110.960670][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.967071][ T5998] [ 110.967071][ T5998] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 110.975321][ T5998] __lock_acquire+0x164c/0x2de0 [ 110.980692][ T5998] lock_acquire+0x115/0x350 [ 110.985701][ T5998] __mutex_lock+0x19d/0x1550 [ 110.990805][ T5998] uvcg_extension_bm_controls_store+0xe4/0xb00 [ 110.997470][ T5998] configfs_write_iter+0x337/0x430 [ 111.003095][ T5998] vfs_write+0x612/0xba0 [ 111.007848][ T5998] ksys_write+0x150/0x270 [ 111.012696][ T5998] do_syscall_64+0x166/0x520 [ 111.017815][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.024228][ T5998] [ 111.024228][ T5998] other info that might help us debug this: [ 111.024228][ T5998] [ 111.034446][ T5998] Chain exists of: [ 111.034446][ T5998] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#25 --> &p->frag_sem [ 111.034446][ T5998] [ 111.048894][ T5998] Possible unsafe locking scenario: [ 111.048894][ T5998] [ 111.056334][ T5998] CPU0 CPU1 [ 111.061683][ T5998] ---- ---- [ 111.067033][ T5998] rlock(&p->frag_sem); [ 111.071266][ T5998] lock(&sb->s_type->i_mutex_key#25); [ 111.079238][ T5998] lock(&p->frag_sem); [ 111.085989][ T5998] lock(gadget_subsys.su_mutex); [ 111.091009][ T5998] [ 111.091009][ T5998] *** DEADLOCK *** [ 111.091009][ T5998] [ 111.099152][ T5998] locks held by syz-executor184/5998: 3, last CPU#1: [ 111.105817][ T5998] #0: ffff88801e7d8460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 111.114802][ T5998] #1: ffff888070770c80 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x7e/0x430 [ 111.124647][ T5998] #2: ffff888028accd70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 111.134397][ T5998] [ 111.134397][ T5998] stack backtrace: [ 111.140269][ T5998] CPU: 1 UID: 0 PID: 5998 Comm: syz-executor184 Not tainted syzkaller #0 PREEMPT(full) [ 111.149969][ T5998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 111.160008][ T5998] Call Trace: [ 111.163272][ T5998] [ 111.166186][ T5998] dump_stack_lvl+0xe8/0x150 [ 111.170777][ T5998] print_circular_bug+0x2e2/0x300 [ 111.175802][ T5998] check_noncircular+0x12f/0x150 [ 111.180747][ T5998] __lock_acquire+0x164c/0x2de0 [ 111.185591][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.191219][ T5998] ? is_bpf_text_address+0x26/0x2b0 [ 111.196416][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.202042][ T5998] ? kernel_text_address+0xa5/0xe0 [ 111.207145][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.212771][ T5998] ? __kernel_text_address+0xd/0x30 [ 111.217960][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.223605][ T5998] ? unwind_get_return_address+0x4d/0x90 [ 111.229244][ T5998] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 111.235397][ T5998] lock_acquire+0x115/0x350 [ 111.239893][ T5998] ? uvcg_extension_bm_controls_store+0xe4/0xb00 [ 111.246212][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.251847][ T5998] __mutex_lock+0x19d/0x1550 [ 111.256431][ T5998] ? uvcg_extension_bm_controls_store+0xe4/0xb00 [ 111.262746][ T5998] ? check_path+0x21/0x40 [ 111.267069][ T5998] ? check_noncircular+0xdb/0x150 [ 111.272091][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.277716][ T5998] ? add_lock_to_list+0xc7/0x100 [ 111.282664][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.288303][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.293939][ T5998] ? uvcg_extension_bm_controls_store+0xe4/0xb00 [ 111.300268][ T5998] ? __pfx___mutex_lock+0x10/0x10 [ 111.305306][ T5998] uvcg_extension_bm_controls_store+0xe4/0xb00 [ 111.311453][ T5998] ? lock_acquire+0x115/0x350 [ 111.316119][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.321761][ T5998] ? __pfx_uvcg_extension_bm_controls_store+0x10/0x10 [ 111.328523][ T5998] ? down_read+0x2be/0x330 [ 111.332940][ T5998] ? __pfx_uvcg_extension_bm_controls_store+0x10/0x10 [ 111.339704][ T5998] configfs_write_iter+0x337/0x430 [ 111.344824][ T5998] vfs_write+0x612/0xba0 [ 111.349070][ T5998] ? __pfx_vfs_write+0x10/0x10 [ 111.353843][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.359473][ T5998] ? kmem_cache_free+0x182/0x650 [ 111.364414][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.370051][ T5998] ? srso_alias_return_thunk+0x5/0xfbef5 [ 111.375718][ T5998] ksys_write+0x150/0x270 [ 111.380058][ T5998] ? __pfx_ksys_write+0x10/0x10 [ 111.384918][ T5998] do_syscall_64+0x166/0x520 [ 111.389505][ T5998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.395566][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.401458][ T5998] RIP: 0033:0x7fa3e20116b7 [ 111.405869][ T5998] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 111.425464][ T5998] RSP: 002b:00007ffcaf360150 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 111.433880][ T5998] RAX: ffffffffffffffda RBX: 000055558f99e400 RCX: 00007fa3e20116b7 [ 111.441853][ T5998] RDX: 0000000000000002 RSI: 00007fa3e204d174 RDI: 0000000000000003 [ 111.449815][ T5998] RBP: 00007fa3e204fc38 R08: 0000000000000000 R09: 0000000000000000 [+] write to /sys/kernel/config/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0/bmControls successful (Edge #0 executed, circular dependency triggered). [+] close /sys/kernel/config/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0/bmControls fd successful. [*] [After write] lockdep debug_locks status: 0 [ 111.457881][ T5998] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffcaf360230 [ 111.465854][ T5998] R13: 000055558f99fdb0 R14: 000055558f99e3d8 R15: 000055558f9a7e4b [ 111.473880][ T5998] [+] Reproducer finished.