program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x14, 0x4, 0x4, 0x6}, 0x48) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x3b) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1f7) openat(0xffffffffffffff9c, &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x800, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0, 0xffffffffffffffff}, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) rmdir(&(0x7f0000000340)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00') r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f00000005c0)="bad386dd", 0x5dc, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r4, 0x1, 0xd8, 0x6, @multicast}, 0x14) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0x100, 0x0) quotactl_fd$Q_GETFMT(r6, 0xffffffff80000401, 0x0, &(0x7f0000000200)) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@bloom_filter={0x1e, 0x8001, 0x4, 0x7ff, 0x403, r2, 0xffff, '\x00', r4, r6, 0x1, 0x4, 0x2, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000080), &(0x7f0000000140)=@udp6=r1, 0x2}, 0x20) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r7, 0x40045568, 0x18) [ 106.876677][ T4637] Bluetooth: hci0: command tx timeout [ 106.976338][ T24] audit: type=1800 audit(1786397398.740:2): pid=5315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="alua_tg_pt_offline" dev="configfs" ino=4233 res=0 errno=0 [ 107.042107][ T5316] [ 107.043135][ T5316] ====================================================== [ 107.045794][ T5316] WARNING: possible circular locking dependency detected [ 107.048327][ T5316] syzkaller #0 Not tainted [ 107.049955][ T5316] ------------------------------------------------------ [ 107.052534][ T5316] syz.0.0/5316 is trying to acquire lock: [ 107.054796][ T5316] ffffffff8f7173e8 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 107.058665][ T5316] [ 107.058665][ T5316] but task is already holding lock: [ 107.061647][ T5316] ffff8880123ab580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 107.065144][ T5316] [ 107.065144][ T5316] which lock already depends on the new lock. [ 107.065144][ T5316] [ 107.069482][ T5316] [ 107.069482][ T5316] the existing dependency chain (in reverse order) is: [ 107.073249][ T5316] [ 107.073249][ T5316] -> #3 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 107.076889][ T5316] down_write+0x96/0x200 [ 107.079059][ T5316] configfs_depend_item_unlocked+0x153/0x420 [ 107.081661][ T5316] usbg_make_tpg+0x1f6/0x590 [ 107.083811][ T5316] target_fabric_make_tpg+0xa8/0x6d0 [ 107.086265][ T5316] configfs_mkdir+0x4f6/0x9e0 [ 107.088457][ T5316] vfs_mkdir+0x406/0x620 [ 107.090503][ T5316] filename_mkdirat+0x285/0x510 [ 107.092727][ T5316] __se_sys_mkdir+0x34/0x150 [ 107.094750][ T5316] do_syscall_64+0x174/0x580 [ 107.096872][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.099463][ T5316] [ 107.099463][ T5316] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 107.102733][ T5316] __mutex_lock+0x19d/0x1550 [ 107.104862][ T5316] usbg_make_tpg+0x147/0x590 [ 107.106823][ T5316] target_fabric_make_tpg+0xa8/0x6d0 [ 107.109169][ T5316] configfs_mkdir+0x4f6/0x9e0 [ 107.111242][ T5316] vfs_mkdir+0x406/0x620 [ 107.113147][ T5316] filename_mkdirat+0x285/0x510 [ 107.115264][ T5316] __se_sys_mkdir+0x34/0x150 [ 107.117431][ T5316] do_syscall_64+0x174/0x580 [ 107.119554][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.122033][ T5316] [ 107.122033][ T5316] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 107.125162][ T5316] __mutex_lock+0x19d/0x1550 [ 107.127166][ T5316] usbg_make_tpg+0xf7/0x590 [ 107.129279][ T5316] target_fabric_make_tpg+0xa8/0x6d0 [ 107.131668][ T5316] configfs_mkdir+0x4f6/0x9e0 [ 107.133795][ T5316] vfs_mkdir+0x406/0x620 [ 107.135768][ T5316] filename_mkdirat+0x285/0x510 [ 107.138042][ T5316] __se_sys_mkdir+0x34/0x150 [ 107.140172][ T5316] do_syscall_64+0x174/0x580 [ 107.142264][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.144954][ T5316] [ 107.144954][ T5316] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 107.147985][ T5316] __lock_acquire+0x1520/0x2cf0 [ 107.150182][ T5316] lock_acquire+0x106/0x350 [ 107.152214][ T5316] __mutex_lock+0x19d/0x1550 [ 107.154234][ T5316] configfs_rmdir+0x5f0/0x950 [ 107.156508][ T5316] vfs_rmdir+0x3e6/0x6a0 [ 107.158447][ T5316] filename_rmdir+0x292/0x520 [ 107.160481][ T5316] __se_sys_rmdir+0x2e/0x140 [ 107.162601][ T5316] do_syscall_64+0x174/0x580 [ 107.164753][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.167280][ T5316] [ 107.167280][ T5316] other info that might help us debug this: [ 107.167280][ T5316] [ 107.171438][ T5316] Chain exists of: [ 107.171438][ T5316] &subsys->su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 107.171438][ T5316] [ 107.177142][ T5316] Possible unsafe locking scenario: [ 107.177142][ T5316] [ 107.180200][ T5316] CPU0 CPU1 [ 107.182405][ T5316] ---- ---- [ 107.184636][ T5316] lock(&sb->s_type->i_mutex_key#24); [ 107.186962][ T5316] lock(&opts->dep_lock); [ 107.189846][ T5316] lock(&sb->s_type->i_mutex_key#24); [ 107.193084][ T5316] lock(&subsys->su_mutex); [ 107.194988][ T5316] [ 107.194988][ T5316] *** DEADLOCK *** [ 107.194988][ T5316] [ 107.198279][ T5316] 3 locks held by syz.0.0/5316: [ 107.200265][ T5316] #0: ffff888000bbe450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 107.203961][ T5316] #1: ffff8880416d7a40 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 [ 107.208659][ T5316] #2: ffff8880123ab580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 107.212750][ T5316] [ 107.212750][ T5316] stack backtrace: [ 107.214967][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 107.214982][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.214991][ T5316] Call Trace: [ 107.214999][ T5316] [ 107.215004][ T5316] dump_stack_lvl+0xe8/0x150 [ 107.215024][ T5316] print_circular_bug+0x2e1/0x300 [ 107.215044][ T5316] check_noncircular+0x12e/0x150 [ 107.215063][ T5316] __lock_acquire+0x1520/0x2cf0 [ 107.215082][ T5316] ? set_normalized_timespec64+0xf0/0x1a0 [ 107.215096][ T5316] ? __lock_acquire+0x683/0x2cf0 [ 107.215106][ T5316] ? configfs_rmdir+0x5f0/0x950 [ 107.215115][ T5316] lock_acquire+0x106/0x350 [ 107.215124][ T5316] ? configfs_rmdir+0x5f0/0x950 [ 107.215136][ T5316] __mutex_lock+0x19d/0x1550 [ 107.215151][ T5316] ? configfs_rmdir+0x5f0/0x950 [ 107.215166][ T5316] ? do_raw_spin_unlock+0x4d/0x210 [ 107.215178][ T5316] ? reacquire_held_locks+0x104/0x190 [ 107.215193][ T5316] ? configfs_rmdir+0x5f0/0x950 [ 107.215207][ T5316] ? fast_dput+0x29c/0x670 [ 107.215219][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 107.215235][ T5316] ? _raw_spin_unlock+0x28/0x50 [ 107.215246][ T5316] ? fast_dput+0x469/0x670 [ 107.215259][ T5316] configfs_rmdir+0x5f0/0x950 [ 107.215272][ T5316] vfs_rmdir+0x3e6/0x6a0 [ 107.215281][ T5316] ? bpf_lsm_path_rmdir+0x9/0x20 [ 107.215292][ T5316] filename_rmdir+0x292/0x520 [ 107.215302][ T5316] ? __pfx_filename_rmdir+0x10/0x10 [ 107.215317][ T5316] ? do_getname+0x151/0x250 [ 107.215327][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.215338][ T5316] __se_sys_rmdir+0x2e/0x140 [ 107.215354][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.215365][ T5316] do_syscall_64+0x174/0x580 [ 107.215380][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 107.215392][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.215402][ T5316] RIP: 0033:0x7efd5659e0d9 [ 107.215411][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.215421][ T5316] RSP: 002b:00007efd5752afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 107.215433][ T5316] RAX: ffffffffffffffda RBX: 00007efd56826090 RCX: 00007efd5659e0d9 [ 107.215442][ T5316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000340 [ 107.215449][ T5316] RBP: 00007efd56635024 R08: 0000000000000000 R09: 0000000000000000 [ 107.215456][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.215463][ T5316] R13: 00007efd56826128 R14: 00007efd56826090 R15: 00007ffc7c7e0c78 [ 107.215475][ T5316]