file system registered
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G        W    L     
------------------------------------------------------
syz.2.2437/12753 is trying to acquire lock:
ffff800088854088 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x434/0x728 fs/configfs/dir.c:1556

but task is already holding lock:
ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: inode_lock include/linux/fs.h:1025 [inline]
ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir fs/namei.c:5500 [inline]
ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir+0xac/0x638 fs/namei.c:5488

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&sb->s_type->i_mutex_key#27){++++}-{4:4}:
       lock_acquire kernel/locking/lockdep.c:5886 [inline]
       lock_acquire+0x3d0/0x44c kernel/locking/lockdep.c:5843
       down_write+0xb4/0x1ac kernel/locking/rwsem.c:1631
       inode_lock include/linux/fs.h:1025 [inline]
       configfs_depend_item_unlocked+0xac/0x500 fs/configfs/dir.c:1259
       usbg_make_tpg+0x1cc/0x47c drivers/usb/gadget/function/f_tcm.c:1692
       target_fabric_make_tpg+0x84/0x738 drivers/target/target_core_fabric_configfs.c:947
       configfs_mkdir+0x394/0xb78 fs/configfs/dir.c:1360
       vfs_mkdir+0x1dc/0x5bc fs/namei.c:5410
       filename_mkdirat+0x354/0x408 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x90/0xd4 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
       el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
       do_el0_svc_compat+0x40/0x58 arch/arm64/kernel/syscall.c:146
       el0_svc_compat+0x54/0x264 arch/arm64/kernel/entry-common.c:909
       el0t_32_sync_handler+0x88/0xac arch/arm64/kernel/entry-common.c:927
       el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595

-> #2 (tpg_instances_lock){+.+.}-{4:4}:
       lock_acquire kernel/locking/lockdep.c:5886 [inline]
       lock_acquire+0x3d0/0x44c kernel/locking/lockdep.c:5843
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x150/0x1530 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       tcm_alloc_inst+0x64/0x1b0 drivers/usb/gadget/function/f_tcm.c:2687
       try_get_usb_function_instance+0x100/0x1d0 drivers/usb/gadget/functions.c:28
       usb_get_function_instance+0x18/0x60 drivers/usb/gadget/functions.c:44
       function_make+0x14c/0x2f0 drivers/usb/gadget/configfs.c:626
       configfs_mkdir+0x394/0xb78 fs/configfs/dir.c:1360
       vfs_mkdir+0x1dc/0x5bc fs/namei.c:5410
       filename_mkdirat+0x354/0x408 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x90/0xd4 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
       el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
       do_el0_svc_compat+0x40/0x58 arch/arm64/kernel/syscall.c:146
       el0_svc_compat+0x54/0x264 arch/arm64/kernel/entry-common.c:909
       el0t_32_sync_handler+0x88/0xac arch/arm64/kernel/entry-common.c:927
       el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595

-> #1 (func_lock){+.+.}-{4:4}:
       lock_acquire kernel/locking/lockdep.c:5886 [inline]
       lock_acquire+0x3d0/0x44c kernel/locking/lockdep.c:5843
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x150/0x1530 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       try_get_usb_function_instance+0x2c/0x1d0 drivers/usb/gadget/functions.c:18
       usb_get_function_instance+0x18/0x60 drivers/usb/gadget/functions.c:44
       function_make+0x14c/0x2f0 drivers/usb/gadget/configfs.c:626
       configfs_mkdir+0x394/0xb78 fs/configfs/dir.c:1360
       vfs_mkdir+0x1dc/0x5bc fs/namei.c:5410
       filename_mkdirat+0x354/0x408 fs/namei.c:5443
       __do_sys_mkdirat fs/namei.c:5464 [inline]
       __se_sys_mkdirat fs/namei.c:5461 [inline]
       __arm64_sys_mkdirat+0x90/0xd4 fs/namei.c:5461
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
       el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
       do_el0_svc_compat+0x40/0x58 arch/arm64/kernel/syscall.c:146
       el0_svc_compat+0x54/0x264 arch/arm64/kernel/entry-common.c:909
       el0t_32_sync_handler+0x88/0xac arch/arm64/kernel/entry-common.c:927
       el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595

-> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}:
       check_prev_add+0x114/0xca0 kernel/locking/lockdep.c:3181
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x13f4/0x1a5c kernel/locking/lockdep.c:5253
       lock_acquire kernel/locking/lockdep.c:5886 [inline]
       lock_acquire+0x3d0/0x44c kernel/locking/lockdep.c:5843
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x150/0x1530 kernel/locking/mutex.c:821
       mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
       configfs_rmdir+0x434/0x728 fs/configfs/dir.c:1556
       vfs_rmdir fs/namei.c:5515 [inline]
       vfs_rmdir+0x230/0x638 fs/namei.c:5488
       filename_rmdir+0x240/0x3e8 fs/namei.c:5572
       __do_sys_rmdir fs/namei.c:5595 [inline]
       __se_sys_rmdir fs/namei.c:5592 [inline]
       __arm64_sys_rmdir+0x4c/0x78 fs/namei.c:5592
       __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
       invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
       el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
       do_el0_svc_compat+0x40/0x58 arch/arm64/kernel/syscall.c:146
       el0_svc_compat+0x54/0x264 arch/arm64/kernel/entry-common.c:909
       el0t_32_sync_handler+0x88/0xac arch/arm64/kernel/entry-common.c:927
       el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595

other info that might help us debug this:

Chain exists of:
  gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#27

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sb->s_type->i_mutex_key#27);
                               lock(tpg_instances_lock);
                               lock(&sb->s_type->i_mutex_key#27);
  lock(gadget_subsys.su_mutex);

 *** DEADLOCK ***

locks held by syz.2.2437/12753: 3, last CPU#0:
 #0: ffff00000fe9e460 (sb_writers#15){.+.+}-{0:0}, at: percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
 #0: ffff00000fe9e460 (sb_writers#15){.+.+}-{0:0}, at: __sb_start_write include/linux/fs/super.h:19 [inline]
 #0: ffff00000fe9e460 (sb_writers#15){.+.+}-{0:0}, at: sb_start_write include/linux/fs/super.h:125 [inline]
 #0: ffff00000fe9e460 (sb_writers#15){.+.+}-{0:0}, at: mnt_want_write+0x3c/0xb0 fs/namespace.c:494
 #1: ffff00001d946740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1070 [inline]
 #1: ffff00001d946740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline]
 #1: ffff00001d946740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline]
 #1: ffff00001d946740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x1b8/0x3e8 fs/namei.c:5565
 #2: ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: inode_lock include/linux/fs.h:1025 [inline]
 #2: ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir fs/namei.c:5500 [inline]
 #2: ffff0000265ffa40 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir+0xac/0x638 fs/namei.c:5488

stack backtrace:
CPU: 0 UID: 0 PID: 12753 Comm: syz.2.2437 Tainted: G        W    L      syzkaller #0 PREEMPT 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x7c/0xb0 lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_circular_bug+0x23c/0x284 kernel/locking/lockdep.c:2059
 check_noncircular+0x174/0x194 kernel/locking/lockdep.c:2191
 check_prev_add+0x114/0xca0 kernel/locking/lockdep.c:3181
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x13f4/0x1a5c kernel/locking/lockdep.c:5253
 lock_acquire kernel/locking/lockdep.c:5886 [inline]
 lock_acquire+0x3d0/0x44c kernel/locking/lockdep.c:5843
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x150/0x1530 kernel/locking/mutex.c:821
 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
 configfs_rmdir+0x434/0x728 fs/configfs/dir.c:1556
 vfs_rmdir fs/namei.c:5515 [inline]
 vfs_rmdir+0x230/0x638 fs/namei.c:5488
 filename_rmdir+0x240/0x3e8 fs/namei.c:5572
 __do_sys_rmdir fs/namei.c:5595 [inline]
 __se_sys_rmdir fs/namei.c:5592 [inline]
 __arm64_sys_rmdir+0x4c/0x78 fs/namei.c:5592
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
 do_el0_svc_compat+0x40/0x58 arch/arm64/kernel/syscall.c:146
 el0_svc_compat+0x54/0x264 arch/arm64/kernel/entry-common.c:909
 el0t_32_sync_handler+0x88/0xac arch/arm64/kernel/entry-common.c:927
 el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595
unloading