From: syzbot <syzbot+56ec747ac8dd3a35cdeb@syzkaller.appspotmail.com>
To: a.hindborg@kernel.org, leitao@debian.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [fs?] possible deadlock in uvcg_frame_dw_max_video_frame_buffer_size_show
Date: Tue, 25 Aug 2026 21:13:23 -0700 [thread overview]
Message-ID: <6a8e67e3.91706f20.ef82.0014.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=133d1549580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8a263b38e64491d5
dashboard link: https://syzkaller.appspot.com/bug?extid=56ec747ac8dd3a35cdeb
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/987f25555283/disk-818bebeb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0b351e1afd72/vmlinux-818bebeb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/58f64cf2ad53/bzImage-818bebeb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+56ec747ac8dd3a35cdeb@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G L
------------------------------------------------------
syz.6.2659/15951 is trying to acquire lock:
ffffffff8ef795e0 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_frame_dw_max_video_frame_buffer_size_show+0x6c/0x180 drivers/usb/gadget/function/uvc_configfs.c:2033
but task is already holding lock:
ffff888040528a68 (&p->frag_sem){++++}-{4:4}, at: fill_read_buffer fs/configfs/file.c:66 [inline]
ffff888040528a68 (&p->frag_sem){++++}-{4:4}, at: configfs_read_iter+0x1cf/0x620 fs/configfs/file.c:88
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&p->frag_sem){++++}-{4:4}:
down_write_killable+0x4a/0x80 kernel/locking/rwsem.c:1643
configfs_rmdir+0x3b0/0x950 fs/configfs/dir.c:1534
vfs_rmdir+0x3e9/0x6b0 fs/namei.c:5515
filename_rmdir+0x292/0x520 fs/namei.c:5572
__do_sys_rmdir fs/namei.c:5595 [inline]
__se_sys_rmdir+0x2e/0x140 fs/namei.c:5592
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&sb->s_type->i_mutex_key#27){++++}-{4:4}:
down_write+0x3a/0x50 kernel/locking/rwsem.c:1631
inode_lock include/linux/fs.h:1025 [inline]
configfs_depend_item_unlocked+0x153/0x420 fs/configfs/dir.c:1259
usbg_make_tpg+0x1f6/0x590 drivers/usb/gadget/function/f_tcm.c:1686
target_fabric_make_tpg+0xa8/0x6d0 drivers/target/target_core_fabric_configfs.c:939
configfs_mkdir+0x4f6/0x9e0 fs/configfs/dir.c:1360
vfs_mkdir+0x408/0x620 fs/namei.c:5410
filename_mkdirat+0x289/0x520 fs/namei.c:5443
__do_sys_mkdir fs/namei.c:5470 [inline]
__se_sys_mkdir+0x34/0x150 fs/namei.c:5467
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&opts->dep_lock){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
tcm_set_name+0x2b/0xd0 drivers/usb/gadget/function/f_tcm.c:2669
function_make+0x1a8/0x360 drivers/usb/gadget/configfs.c:636
configfs_mkdir+0x4f6/0x9e0 fs/configfs/dir.c:1360
vfs_mkdir+0x408/0x620 fs/namei.c:5410
filename_mkdirat+0x289/0x520 fs/namei.c:5443
__do_sys_mkdir fs/namei.c:5470 [inline]
__se_sys_mkdir+0x34/0x150 fs/namei.c:5467
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1520/0x2ce0 kernel/locking/lockdep.c:5253
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
uvcg_frame_dw_max_video_frame_buffer_size_show+0x6c/0x180 drivers/usb/gadget/function/uvc_configfs.c:2033
fill_read_buffer fs/configfs/file.c:68 [inline]
configfs_read_iter+0x2ba/0x620 fs/configfs/file.c:88
__kernel_read+0x4d3/0x970 fs/read_write.c:532
integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline]
ima_calc_file_hash+0x45d/0x8a0 security/integrity/ima/ima_crypto.c:280
ima_collect_measurement+0x521/0xa10 security/integrity/ima/ima_api.c:300
process_measurement+0x1282/0x1c20 security/integrity/ima/ima_main.c:425
ima_file_check+0xe1/0x130 security/integrity/ima/ima_main.c:685
security_file_post_open+0xb3/0x260 security/security.c:2755
do_open fs/namei.c:4839 [inline]
path_openat+0x148a/0x1d60 fs/namei.c:5000
do_file_open+0x23e/0x4a0 fs/namei.c:5029
do_sys_openat2+0x115/0x200 fs/open.c:1417
do_sys_open fs/open.c:1423 [inline]
__do_sys_open fs/open.c:1431 [inline]
__se_sys_open fs/open.c:1427 [inline]
__x64_sys_open+0x11e/0x150 fs/open.c:1427
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#27 --> &p->frag_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(&p->frag_sem);
lock(&sb->s_type->i_mutex_key#27);
lock(&p->frag_sem);
lock(gadget_subsys.su_mutex);
*** DEADLOCK ***
locks held by syz.6.2659/15951: 3, last CPU#0:
#0: ffff88803b82a658 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7e0/0x1c20 security/integrity/ima/ima_main.c:319
#1: ffff888033ff3078 (&buffer->mutex){+.+.}-{4:4}, at: configfs_read_iter+0x73/0x620 fs/configfs/file.c:86
#2: ffff888040528a68 (&p->frag_sem){++++}-{4:4}, at: fill_read_buffer fs/configfs/file.c:66 [inline]
#2: ffff888040528a68 (&p->frag_sem){++++}-{4:4}, at: configfs_read_iter+0x1cf/0x620 fs/configfs/file.c:88
stack backtrace:
CPU: 0 UID: 0 PID: 15951 Comm: syz.6.2659 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2059
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2191
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1520/0x2ce0 kernel/locking/lockdep.c:5253
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
__mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
uvcg_frame_dw_max_video_frame_buffer_size_show+0x6c/0x180 drivers/usb/gadget/function/uvc_configfs.c:2033
fill_read_buffer fs/configfs/file.c:68 [inline]
configfs_read_iter+0x2ba/0x620 fs/configfs/file.c:88
__kernel_read+0x4d3/0x970 fs/read_write.c:532
integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline]
ima_calc_file_hash+0x45d/0x8a0 security/integrity/ima/ima_crypto.c:280
ima_collect_measurement+0x521/0xa10 security/integrity/ima/ima_api.c:300
process_measurement+0x1282/0x1c20 security/integrity/ima/ima_main.c:425
ima_file_check+0xe1/0x130 security/integrity/ima/ima_main.c:685
security_file_post_open+0xb3/0x260 security/security.c:2755
do_open fs/namei.c:4839 [inline]
path_openat+0x148a/0x1d60 fs/namei.c:5000
do_file_open+0x23e/0x4a0 fs/namei.c:5029
do_sys_openat2+0x115/0x200 fs/open.c:1417
do_sys_open fs/open.c:1423 [inline]
__do_sys_open fs/open.c:1431 [inline]
__se_sys_open fs/open.c:1427 [inline]
__x64_sys_open+0x11e/0x150 fs/open.c:1427
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fae2ac1e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fae28a11028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fae2aea6270 RCX: 00007fae2ac1e0d9
RDX: 0000000000000082 RSI: 0000000000000000 RDI: 0000200000000640
RBP: 00007fae2acb5024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fae2aea6308 R14: 00007fae2aea6270 R15: 00007ffdeb312178
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-08-26 4:13 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a8e67e3.91706f20.ef82.0014.GAE@google.com \
--to=syzbot+56ec747ac8dd3a35cdeb@syzkaller.appspotmail.com \
--cc=a.hindborg@kernel.org \
--cc=leitao@debian.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.