Re: [BUG] usb: gadget: f_tcm: possible circular locking dependency in usbg_make_tpg

[Greg KH]

On Mon, Aug 31, 2026 at 05:26:19PM +0800, ZW Tang wrote:
> Hi,
> 
> I am reporting a possible circular locking dependency triggered by a
> syzkaller reproducer on Linux 7.2.0-rc3. Similar issues appear to have
> been reported upstream before, but I can still reproduce this warning on
> Linux 7.2.0-rc3 with HEAD commit
> 1137d8b5df06137fb49513cc923b3b24d94cb809.
> 
> The reproducer mounts configfs, creates a USB gadget TCM function, creates
> a target usb_gadget fabric TPG, and then links the TCM function into a USB
> gadget configuration.
> 
> Lockdep reports a cycle involving the configfs inode mutex,
> tpg_instances_lock, and the f_tcm opts->dep_lock. The current path is
> creating a TPG through configfs_mkdir(). It reaches usbg_make_tpg(), holds
> tpg_instances_lock and opts->dep_lock, and then calls
> configfs_depend_item_unlocked(), which tries to acquire a configfs inode
> mutex.
> 
> The existing reverse dependency is created by the USB gadget symlink path:
> configfs_symlink() calls config_usb_cfg_link(), which calls
> usb_get_function() and then tcm_alloc(), where tpg_instances_lock is
> acquired.
> 
> This creates the following lock order cycle:
> 
> configfs inode mutex -> tpg_instances_lock -> opts->dep_lock
> opts->dep_lock -> configfs inode mutex
> 
> This looks like a lock-ordering issue in the USB gadget TCM function /
> target configfs integration. The kernel should avoid taking these locks in
> opposite orders, because this can lead to an actual deadlock.

Great, care to send a patch to fix this as you have a reproducer for the
issue?

thanks,

greg k-h