====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.1.18/4044 is trying to acquire lock: ffffffff89acc060 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x2a/0x3fc drivers/usb/gadget/function/f_tcm.c:2733 but task is already holding lock: ffffaf8030a1c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a drivers/usb/gadget/configfs.c:439 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&gi->lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x23e/0x4f2 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0x192e kernel/locking/mutex.c:821 mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:874 config_usb_cfg_link+0x4a/0x31a drivers/usb/gadget/configfs.c:439 configfs_symlink+0x460/0xfee fs/configfs/symlink.c:196 vfs_symlink fs/namei.c:5660 [inline] vfs_symlink+0x162/0x45e fs/namei.c:5639 filename_symlinkat+0x264/0x4ca fs/namei.c:5685 __do_sys_symlinkat fs/namei.c:5705 [inline] __se_sys_symlinkat fs/namei.c:5700 [inline] __riscv_sys_symlinkat+0x90/0xce fs/namei.c:5700 syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x23e/0x4f2 kernel/locking/lockdep.c:5825 down_write+0x9c/0x18e kernel/locking/rwsem.c:1631 inode_lock include/linux/fs.h:1024 [inline] configfs_depend_item_unlocked+0xdc/0x5b0 fs/configfs/dir.c:1259 usbg_make_tpg+0x27e/0x602 drivers/usb/gadget/function/f_tcm.c:1686 target_fabric_make_tpg+0x88/0x76c drivers/target/target_core_fabric_configfs.c:939 configfs_mkdir+0x478/0xa24 fs/configfs/dir.c:1360 vfs_mkdir+0x2ea/0x708 fs/namei.c:5276 filename_mkdirat+0x414/0x54a fs/namei.c:5309 __do_sys_mkdirat fs/namei.c:5330 [inline] __se_sys_mkdirat fs/namei.c:5327 [inline] __riscv_sys_mkdirat+0x84/0xbc fs/namei.c:5327 syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 -> #1 (&opts->dep_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x23e/0x4f2 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0x192e kernel/locking/mutex.c:821 mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:874 usbg_make_tpg+0x1d0/0x602 drivers/usb/gadget/function/f_tcm.c:1678 target_fabric_make_tpg+0x88/0x76c drivers/target/target_core_fabric_configfs.c:939 configfs_mkdir+0x478/0xa24 fs/configfs/dir.c:1360 vfs_mkdir+0x2ea/0x708 fs/namei.c:5276 filename_mkdirat+0x414/0x54a fs/namei.c:5309 __do_sys_mkdirat fs/namei.c:5330 [inline] __se_sys_mkdirat fs/namei.c:5327 [inline] __riscv_sys_mkdirat+0x84/0xbc fs/namei.c:5327 syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 -> #0 (tpg_instances_lock){+.+.}-{4:4}: check_noncircular+0x138/0x14c kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0xe9c/0x25aa kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x23e/0x4f2 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0x192e kernel/locking/mutex.c:821 mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:874 tcm_alloc+0x2a/0x3fc drivers/usb/gadget/function/f_tcm.c:2733 usb_get_function+0x50/0xbc drivers/usb/gadget/functions.c:61 config_usb_cfg_link+0x1a4/0x31a drivers/usb/gadget/configfs.c:469 configfs_symlink+0x460/0xfee fs/configfs/symlink.c:196 vfs_symlink fs/namei.c:5660 [inline] vfs_symlink+0x162/0x45e fs/namei.c:5639 filename_symlinkat+0x264/0x4ca fs/namei.c:5685 __do_sys_symlinkat fs/namei.c:5705 [inline] __se_sys_symlinkat fs/namei.c:5700 [inline] __riscv_sys_symlinkat+0x90/0xce fs/namei.c:5700 syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 other info that might help us debug this: Chain exists of: tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&gi->lock); lock(&sb->s_type->i_mutex_key#24); lock(&gi->lock); lock(tpg_instances_lock); *** DEADLOCK *** 3 locks held by syz.1.18/4044: #0: ffffaf8013f04450 (sb_writers#12){.+.+}-{0:0}, at: percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] #0: ffffaf8013f04450 (sb_writers#12){.+.+}-{0:0}, at: __sb_start_write include/linux/fs/super.h:19 [inline] #0: ffffaf8013f04450 (sb_writers#12){.+.+}-{0:0}, at: sb_start_write include/linux/fs/super.h:125 [inline] #0: ffffaf8013f04450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x42/0x39e fs/namespace.c:494 #1: ffffaf8021b98600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #1: ffffaf8021b98600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x336/0xfee fs/configfs/symlink.c:186 #2: ffffaf8030a1c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a drivers/usb/gadget/configfs.c:439 stack backtrace: CPU: 0 UID: 0 PID: 4044 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x114/0x1aa lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] print_circular_bug+0x250/0x29c kernel/locking/lockdep.c:2043 [] check_noncircular+0x138/0x14c kernel/locking/lockdep.c:2175 [] check_prev_add kernel/locking/lockdep.c:3165 [inline] [] check_prevs_add kernel/locking/lockdep.c:3284 [inline] [] validate_chain kernel/locking/lockdep.c:3908 [inline] [] __lock_acquire+0xe9c/0x25aa kernel/locking/lockdep.c:5237 [] lock_acquire kernel/locking/lockdep.c:5868 [inline] [] lock_acquire+0x23e/0x4f2 kernel/locking/lockdep.c:5825 [] __mutex_lock_common kernel/locking/mutex.c:646 [inline] [] __mutex_lock+0x164/0x192e kernel/locking/mutex.c:821 [] mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:874 [] tcm_alloc+0x2a/0x3fc drivers/usb/gadget/function/f_tcm.c:2733 [] usb_get_function+0x50/0xbc drivers/usb/gadget/functions.c:61 [] config_usb_cfg_link+0x1a4/0x31a drivers/usb/gadget/configfs.c:469 [] configfs_symlink+0x460/0xfee fs/configfs/symlink.c:196 [] vfs_symlink fs/namei.c:5660 [inline] [] vfs_symlink+0x162/0x45e fs/namei.c:5639 [] filename_symlinkat+0x264/0x4ca fs/namei.c:5685 [] __do_sys_symlinkat fs/namei.c:5705 [inline] [] __se_sys_symlinkat fs/namei.c:5700 [inline] [] __riscv_sys_symlinkat+0x90/0xce fs/namei.c:5700 [] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 [] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237