program: mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x19, 0x4, 0x8, 0x8, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7fff}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1\x00', 0x1, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8001, 0x0, 0x8, 0x0) write(r1, &(0x7f0000000a00)='rd_pages=8', 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./myconfig/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0\x00', 0x1ff) symlinkat(&(0x7f0000000800)='./myconfig/usb_gadget/g1/strings/0x409/s1\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./myconfig/usb_gadget/g1/functions/uvc.usb0/control/extensions/ext.0/str\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000c00)='1', 0x1) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') [ 94.891847][ T4637] Bluetooth: hci0: command tx timeout [ 95.044828][ T5313] [ 95.046014][ T5313] ====================================================== [ 95.049210][ T5313] WARNING: possible circular locking dependency detected [ 95.052219][ T5313] syzkaller #0 Not tainted [ 95.054137][ T5313] ------------------------------------------------------ [ 95.057090][ T5313] syz.0.0/5313 is trying to acquire lock: [ 95.059390][ T5313] ffffffff8f9ed628 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_extension_allow_link+0x6c/0x1f0 [ 95.065288][ T5313] [ 95.065288][ T5313] but task is already holding lock: [ 95.068411][ T5313] ffff888013125900 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 95.072741][ T5313] [ 95.072741][ T5313] which lock already depends on the new lock. [ 95.072741][ T5313] [ 95.077095][ T5313] [ 95.077095][ T5313] the existing dependency chain (in reverse order) is: [ 95.080783][ T5313] [ 95.080783][ T5313] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 95.084466][ T5313] down_write+0x96/0x200 [ 95.086582][ T5313] configfs_depend_item_unlocked+0x153/0x420 [ 95.089382][ T5313] usbg_make_tpg+0x1f6/0x590 [ 95.091563][ T5313] target_fabric_make_tpg+0xa8/0x6d0 [ 95.094128][ T5313] configfs_mkdir+0x4f6/0x9e0 [ 95.096169][ T5313] vfs_mkdir+0x406/0x620 [ 95.098108][ T5313] filename_mkdirat+0x285/0x510 [ 95.100316][ T5313] __se_sys_mkdir+0x34/0x150 [ 95.102473][ T5313] do_syscall_64+0x174/0x580 [ 95.104569][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.107395][ T5313] [ 95.107395][ T5313] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 95.110605][ T5313] __mutex_lock+0x19d/0x1550 [ 95.112737][ T5313] tcm_set_name+0x2b/0xd0 [ 95.114790][ T5313] function_make+0x1a8/0x360 [ 95.116997][ T5313] configfs_mkdir+0x4f6/0x9e0 [ 95.119273][ T5313] vfs_mkdir+0x406/0x620 [ 95.121369][ T5313] filename_mkdirat+0x285/0x510 [ 95.123636][ T5313] __se_sys_mkdir+0x34/0x150 [ 95.125795][ T5313] do_syscall_64+0x174/0x580 [ 95.127903][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.130457][ T5313] [ 95.130457][ T5313] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 95.133907][ T5313] __lock_acquire+0x1520/0x2cf0 [ 95.136234][ T5313] lock_acquire+0x106/0x350 [ 95.138389][ T5313] __mutex_lock+0x19d/0x1550 [ 95.140216][ T5313] uvcg_extension_allow_link+0x6c/0x1f0 [ 95.142479][ T5313] configfs_symlink+0x59a/0x1030 [ 95.144738][ T5313] vfs_symlink+0x18b/0x330 [ 95.146840][ T5313] filename_symlinkat+0x1cd/0x410 [ 95.148931][ T5313] __se_sys_symlinkat+0x4e/0x2b0 [ 95.151009][ T5313] do_syscall_64+0x174/0x580 [ 95.153151][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.155844][ T5313] [ 95.155844][ T5313] other info that might help us debug this: [ 95.155844][ T5313] [ 95.160169][ T5313] Chain exists of: [ 95.160169][ T5313] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 95.160169][ T5313] [ 95.166080][ T5313] Possible unsafe locking scenario: [ 95.166080][ T5313] [ 95.169160][ T5313] CPU0 CPU1 [ 95.171365][ T5313] ---- ---- [ 95.173434][ T5313] lock(&sb->s_type->i_mutex_key#24); [ 95.175650][ T5313] lock(&opts->dep_lock); [ 95.178578][ T5313] lock(&sb->s_type->i_mutex_key#24); [ 95.181666][ T5313] lock(gadget_subsys.su_mutex); [ 95.183576][ T5313] [ 95.183576][ T5313] *** DEADLOCK *** [ 95.183576][ T5313] [ 95.186915][ T5313] 2 locks held by syz.0.0/5313: [ 95.188747][ T5313] #0: ffff888000b66450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.192625][ T5313] #1: ffff888013125900 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: configfs_symlink+0x3af/0x1030 [ 95.197814][ T5313] [ 95.197814][ T5313] stack backtrace: [ 95.200915][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.200932][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.200940][ T5313] Call Trace: [ 95.200949][ T5313] [ 95.200955][ T5313] dump_stack_lvl+0xe8/0x150 [ 95.200979][ T5313] print_circular_bug+0x2e1/0x300 [ 95.201004][ T5313] check_noncircular+0x12e/0x150 [ 95.201024][ T5313] __lock_acquire+0x1520/0x2cf0 [ 95.201042][ T5313] ? stack_trace_save+0xa9/0x100 [ 95.201056][ T5313] ? __pfx_stack_trace_save+0x10/0x10 [ 95.201070][ T5313] ? check_path+0x21/0x40 [ 95.201087][ T5313] ? check_noncircular+0xda/0x150 [ 95.201106][ T5313] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 95.201125][ T5313] lock_acquire+0x106/0x350 [ 95.201140][ T5313] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 95.201162][ T5313] __mutex_lock+0x19d/0x1550 [ 95.201218][ T5313] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 95.201238][ T5313] ? uvcg_extension_allow_link+0x6c/0x1f0 [ 95.201264][ T5313] ? __pfx___mutex_lock+0x10/0x10 [ 95.201283][ T5313] ? generic_permission+0x2bf/0x670 [ 95.201299][ T5313] uvcg_extension_allow_link+0x6c/0x1f0 [ 95.201319][ T5313] configfs_symlink+0x59a/0x1030 [ 95.201340][ T5313] ? lookup_one_qstr_excl+0x1d4/0x360 [ 95.201356][ T5313] ? make_vfsuid+0x49/0xa0 [ 95.201377][ T5313] ? __pfx_configfs_symlink+0x10/0x10 [ 95.201396][ T5313] ? bpf_lsm_inode_symlink+0x9/0x20 [ 95.201414][ T5313] vfs_symlink+0x18b/0x330 [ 95.201433][ T5313] ? security_path_symlink+0xfd/0x360 [ 95.201453][ T5313] filename_symlinkat+0x1cd/0x410 [ 95.201476][ T5313] ? __pfx_filename_symlinkat+0x10/0x10 [ 95.201495][ T5313] ? do_getname+0x151/0x250 [ 95.201508][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.201521][ T5313] __se_sys_symlinkat+0x4e/0x2b0 [ 95.201541][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.201554][ T5313] do_syscall_64+0x174/0x580 [ 95.201570][ T5313] ? trace_irq_disable+0x3b/0x140 [ 95.201585][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 95.201603][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.201617][ T5313] RIP: 0033:0x7f7020b9e0d9 [ 95.201631][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.201642][ T5313] RSP: 002b:00007f7021a4ffe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 95.201655][ T5313] RAX: ffffffffffffffda RBX: 00007f7020e25fa0 RCX: 00007f7020b9e0d9 [ 95.201664][ T5313] RDX: 0000200000000900 RSI: ffffffffffffff9c RDI: 0000200000000800 [ 95.201673][ T5313] RBP: 00007f7020c35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.201680][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.201686][ T5313] R13: 00007f7020e26038 R14: 00007f7020e25fa0 R15: 00007fffdc263cc8 [ 95.201698][ T5313] [ 95.343381][ T5314] se_device not configured yet, cannot port link