./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1035567368 <...> [ 97.406966][ T9] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.150' (ED25519) to the list of known hosts. execve("./syz-executor1035567368", ["./syz-executor1035567368"], 0x7ffe198fbb20 /* 10 vars */) = 0 brk(NULL) = 0x5555640b8000 brk(0x5555640b8e00) = 0x5555640b8e00 arch_prctl(ARCH_SET_FS, 0x5555640b8480) = 0 set_tid_address(0x5555640b8750) = 5085 set_robust_list(0x5555640b8760, 24) = 0 rseq(0x5555640b8da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1035567368", 4096) = 28 getrandom("\x2d\x6a\x11\x25\x64\x70\x83\xc3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555640b8e00 brk(0x5555640d9e00) = 0x5555640d9e00 brk(0x5555640da000) = 0x5555640da000 mprotect(0x7f23e9811000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f23e976b8e0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f23e97745e0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f23e976b8e0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f23e97745e0}, NULL, 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5086 attached , child_tidptr=0x5555640b8750) = 5086 [pid 5086] set_robust_list(0x5555640b8760, 24) = 0 [pid 5086] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 100.836078][ T29] audit: type=1400 audit(1716473457.679:87): avc: denied { execmem } for pid=5085 comm="syz-executor103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5086] setpgid(0, 0) = 0 [pid 5086] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5086] write(3, "1000", 4) = 4 [pid 5086] close(3) = 0 executing program [pid 5086] write(1, "executing program\n", 18) = 18 [pid 5086] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, insn_cnt=5, insns=0x20000040, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 144) = 3 [ 100.931027][ T29] audit: type=1400 audit(1716473457.779:88): avc: denied { prog_load } for pid=5086 comm="syz-executor103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 100.950666][ T29] audit: type=1400 audit(1716473457.779:89): avc: denied { bpf } for pid=5086 comm="syz-executor103" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 5086] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="mmap_lock_acquire_returned", prog_fd=3}}, 16) = 4 [ 100.973301][ T29] audit: type=1400 audit(1716473457.779:90): avc: denied { perfmon } for pid=5086 comm="syz-executor103" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 100.995624][ T29] audit: type=1400 audit(1716473457.799:91): avc: denied { prog_run } for pid=5086 comm="syz-executor103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 101.032854][ T29] audit: type=1400 audit(1716473457.879:92): avc: denied { map_create } for pid=5086 comm="syz-executor103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 101.052782][ T29] audit: type=1400 audit(1716473457.879:93): avc: denied { map_read map_write } for pid=5086 comm="syz-executor103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 101.073358][ T4524] [ 101.075730][ T4524] ====================================================== [ 101.082756][ T4524] WARNING: possible circular locking dependency detected [ 101.089780][ T4524] 6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted [ 101.096458][ T4524] ------------------------------------------------------ [ 101.103475][ T4524] klogd/4524 is trying to acquire lock: [ 101.109019][ T4524] ffff8880b9338ac0 (lock#9){+.+.}-{2:2}, at: __mmap_lock_do_trace_acquire_returned+0x7f/0x790 [ 101.119352][ T4524] [ 101.119352][ T4524] but task is already holding lock: [ 101.126717][ T4524] ffff8880b933ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 101.136227][ T4524] [ 101.136227][ T4524] which lock already depends on the new lock. [ 101.136227][ T4524] [ 101.146633][ T4524] [ 101.146633][ T4524] the existing dependency chain (in reverse order) is: [ 101.155646][ T4524] [ 101.155646][ T4524] -> #3 (&rq->__lock){-.-.}-{2:2}: [ 101.162968][ T4524] _raw_spin_lock_nested+0x31/0x40 [ 101.168631][ T4524] raw_spin_rq_lock_nested+0x29/0x130 [ 101.174533][ T4524] task_fork_fair+0x73/0x250 [ 101.179652][ T4524] sched_cgroup_fork+0x3cf/0x510 [ 101.185131][ T4524] copy_process+0x439b/0x8f10 [ 101.190351][ T4524] kernel_clone+0xfd/0x980 [ 101.195309][ T4524] user_mode_thread+0xb4/0xf0 [ 101.200527][ T4524] rest_init+0x23/0x2b0 [ 101.205221][ T4524] start_kernel+0x3df/0x4c0 [ 101.210270][ T4524] x86_64_start_reservations+0x18/0x30 [ 101.216283][ T4524] x86_64_start_kernel+0xb2/0xc0 [ 101.221768][ T4524] common_startup_64+0x13e/0x148 [ 101.227243][ T4524] [ 101.227243][ T4524] -> #2 (&p->pi_lock){-.-.}-{2:2}: [ 101.234554][ T4524] _raw_spin_lock_irqsave+0x3a/0x60 [ 101.240294][ T4524] try_to_wake_up+0x9a/0x13e0 [ 101.245505][ T4524] signal_wake_up_state+0x79/0x120 [ 101.251167][ T4524] complete_signal+0x465/0xc10 [ 101.256493][ T4524] __send_signal_locked+0x509/0x11c0 [ 101.262320][ T4524] do_notify_parent+0xeb4/0x1040 [ 101.267792][ T4524] do_exit+0x1369/0x2c10 [ 101.272585][ T4524] do_group_exit+0xd3/0x2a0 [ 101.277637][ T4524] __x64_sys_exit_group+0x3e/0x50 [ 101.283209][ T4524] do_syscall_64+0xcf/0x260 [ 101.288254][ T4524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.294681][ T4524] [ 101.294681][ T4524] -> #1 (&sighand->siglock){....}-{2:2}: [ 101.302527][ T4524] _raw_spin_lock_irqsave+0x3a/0x60 [ 101.308268][ T4524] __lock_task_sighand+0xc2/0x340 [ 101.313818][ T4524] group_send_sig_info+0x290/0x300 [ 101.319477][ T4524] bpf_send_signal_common+0x2e8/0x3a0 [ 101.325392][ T4524] bpf_send_signal_thread+0x16/0x20 [ 101.331132][ T4524] ___bpf_prog_run+0x3e51/0xabd0 [ 101.336618][ T4524] __bpf_prog_run32+0xc1/0x100 [ 101.341921][ T4524] bpf_trace_run4+0x245/0x5a0 [ 101.347151][ T4524] __bpf_trace_mmap_lock_acquire_returned+0x134/0x180 [ 101.354462][ T4524] __mmap_lock_do_trace_acquire_returned+0x456/0x790 [ 101.361702][ T4524] process_vm_rw_core.constprop.0+0x7d7/0xa10 [ 101.368334][ T4524] process_vm_rw+0x301/0x360 [ 101.373466][ T4524] __x64_sys_process_vm_readv+0xe2/0x1c0 [ 101.379658][ T4524] do_syscall_64+0xcf/0x260 [ 101.384715][ T4524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.391146][ T4524] [ 101.391146][ T4524] -> #0 (lock#9){+.+.}-{2:2}: [ 101.398036][ T4524] __lock_acquire+0x2478/0x3b30 [ 101.403525][ T4524] lock_acquire+0x1b1/0x560 [ 101.408580][ T4524] __mmap_lock_do_trace_acquire_returned+0x97/0x790 [ 101.415814][ T4524] stack_map_get_build_id_offset+0x5d9/0x7c0 [ 101.422352][ T4524] __bpf_get_stack+0x6bf/0x700 [ 101.427660][ T4524] bpf_get_stack_raw_tp+0x124/0x160 [ 101.433401][ T4524] ___bpf_prog_run+0x3e51/0xabd0 [ 101.438877][ T4524] __bpf_prog_run32+0xc1/0x100 [ 101.444178][ T4524] bpf_trace_run2+0x231/0x590 [ 101.449407][ T4524] __bpf_trace_tlb_flush+0xd2/0x110 [ 101.455151][ T4524] trace_tlb_flush+0xf3/0x170 [ 101.460376][ T4524] switch_mm_irqs_off+0x68b/0xbc0 [ 101.465947][ T4524] __schedule+0xd2b/0x5d00 [ 101.470905][ T4524] schedule+0xe7/0x350 [ 101.475511][ T4524] syslog_print+0x214/0x5d0 [ 101.480563][ T4524] do_syslog+0x3be/0x6a0 [ 101.485351][ T4524] __x64_sys_syslog+0x74/0xb0 [ 101.490573][ T4524] do_syscall_64+0xcf/0x260 [ 101.495638][ T4524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.502078][ T4524] [ 101.502078][ T4524] other info that might help us debug this: [ 101.502078][ T4524] [ 101.512316][ T4524] Chain exists of: [ 101.512316][ T4524] lock#9 --> &p->pi_lock --> &rq->__lock [ 101.512316][ T4524] [ 101.523907][ T4524] Possible unsafe locking scenario: [ 101.523907][ T4524] [ 101.531360][ T4524] CPU0 CPU1 [ 101.536756][ T4524] ---- ---- [ 101.542136][ T4524] lock(&rq->__lock); [ 101.546307][ T4524] lock(&p->pi_lock); [ 101.552911][ T4524] lock(&rq->__lock); [ 101.559511][ T4524] lock(lock#9); [ 101.563165][ T4524] [ 101.563165][ T4524] *** DEADLOCK *** [ 101.563165][ T4524] [ 101.571316][ T4524] 3 locks held by klogd/4524: [ 101.576004][ T4524] #0: ffff8880b933ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 101.585961][ T4524] #1: ffffffff8dbb1760 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x1c2/0x590 [ 101.595425][ T4524] #2: ffff888015477398 (&mm->mmap_lock){++++}-{3:3}, at: stack_map_get_build_id_offset+0x1e8/0x7c0 [ 101.606241][ T4524] [ 101.606241][ T4524] stack backtrace: [ 101.612133][ T4524] CPU: 1 PID: 4524 Comm: klogd Not tainted 6.9.0-syzkaller-10323-g8f6a15f095a6 #0 [ 101.621339][ T4524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 101.631398][ T4524] Call Trace: [ 101.634682][ T4524] [ 101.637619][ T4524] dump_stack_lvl+0x116/0x1f0 [ 101.642327][ T4524] check_noncircular+0x31a/0x400 [ 101.647294][ T4524] ? __pfx_check_noncircular+0x10/0x10 [ 101.652779][ T4524] ? lockdep_lock+0xc6/0x200 [ 101.657384][ T4524] ? __pfx_lockdep_lock+0x10/0x10 [ 101.662429][ T4524] __lock_acquire+0x2478/0x3b30 [ 101.667326][ T4524] ? __pfx___lock_acquire+0x10/0x10 [ 101.672559][ T4524] ? lock_acquire+0x1b1/0x560 [ 101.677271][ T4524] lock_acquire+0x1b1/0x560 [ 101.681798][ T4524] ? __mmap_lock_do_trace_acquire_returned+0x7f/0x790 [ 101.688592][ T4524] ? __pfx_lock_acquire+0x10/0x10 [ 101.693667][ T4524] ? kvm_guest_state+0xfa/0x160 [ 101.698559][ T4524] ? perf_callchain_user+0x21c/0xa20 [ 101.703870][ T4524] ? down_read_trylock+0x1ed/0x3f0 [ 101.708991][ T4524] ? stack_map_get_build_id_offset+0x1e8/0x7c0 [ 101.715167][ T4524] __mmap_lock_do_trace_acquire_returned+0x97/0x790 [ 101.721793][ T4524] ? __mmap_lock_do_trace_acquire_returned+0x7f/0x790 [ 101.728590][ T4524] ? __pfx_get_perf_callchain+0x10/0x10 [ 101.734166][ T4524] stack_map_get_build_id_offset+0x5d9/0x7c0 [ 101.740166][ T4524] __bpf_get_stack+0x6bf/0x700 [ 101.744953][ T4524] ? __pfx___bpf_get_stack+0x10/0x10 [ 101.750362][ T4524] bpf_get_stack_raw_tp+0x124/0x160 [ 101.755585][ T4524] ? __pfx_bpf_get_stack_raw_tp+0x10/0x10 [ 101.761329][ T4524] ___bpf_prog_run+0x3e51/0xabd0 [ 101.766283][ T4524] ? __pfx_mark_lock+0x10/0x10 [ 101.771072][ T4524] __bpf_prog_run32+0xc1/0x100 [ 101.775854][ T4524] ? __pfx___bpf_prog_run32+0x10/0x10 [ 101.781249][ T4524] ? __pfx_lock_acquire+0x10/0x10 [ 101.786309][ T4524] ? __pfx___cant_migrate+0x10/0x10 [ 101.791531][ T4524] bpf_trace_run2+0x231/0x590 [ 101.796275][ T4524] ? __pfx_bpf_trace_run2+0x10/0x10 [ 101.801496][ T4524] ? find_held_lock+0x2d/0x110 [ 101.806287][ T4524] ? psi_task_switch+0x2d9/0x900 [ 101.811249][ T4524] __bpf_trace_tlb_flush+0xd2/0x110 [ 101.816472][ T4524] ? __pfx___bpf_trace_tlb_flush+0x10/0x10 [ 101.822303][ T4524] ? kvm_sched_clock_read+0x11/0x20 [ 101.827534][ T4524] ? __phys_addr+0xc6/0x150 [ 101.832054][ T4524] trace_tlb_flush+0xf3/0x170 [ 101.836759][ T4524] switch_mm_irqs_off+0x68b/0xbc0 [ 101.841806][ T4524] ? __update_stats_enqueue_sleeper+0x900/0x9f0 [ 101.848067][ T4524] __schedule+0xd2b/0x5d00 [ 101.852512][ T4524] ? __pfx___lock_acquire+0x10/0x10 [ 101.857832][ T4524] ? __pfx___schedule+0x10/0x10 [ 101.862704][ T4524] ? schedule+0x298/0x350 [ 101.867058][ T4524] ? __pfx_lock_release+0x10/0x10 [ 101.872115][ T4524] ? prb_read_valid+0x79/0xb0 [ 101.876824][ T4524] schedule+0xe7/0x350 [ 101.880921][ T4524] syslog_print+0x214/0x5d0 [ 101.885452][ T4524] ? __pfx_syslog_print+0x10/0x10 [ 101.890508][ T4524] ? __pfx_autoremove_wake_function+0x10/0x10 [ 101.896629][ T4524] ? __pfx_avc_has_perm+0x10/0x10 [ 101.901688][ T4524] ? selinux_syslog+0xf1/0x2e0 [ 101.906473][ T4524] do_syslog+0x3be/0x6a0 [ 101.910737][ T4524] ? __pfx_do_syslog+0x10/0x10 [ 101.915522][ T4524] __x64_sys_syslog+0x74/0xb0 [ 101.920220][ T4524] ? lockdep_hardirqs_on+0x7c/0x110 [ 101.925444][ T4524] do_syscall_64+0xcf/0x260 [ 101.929981][ T4524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.935894][ T4524] RIP: 0033:0x7f70c5278fa7 [ 101.940320][ T4524] Code: Unable to access opcode bytes at 0x7f70c5278f7d. [ 101.947344][ T4524] RSP: 002b:00007ffcd7812ff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000067 [ 101.955773][ T4524] RAX: ffffffffffffffda RBX: 00007f70c54174a0 RCX: 00007f70c5278fa7 [ 101.963759][ T4524] RDX: 00000000000003ff RSI: 00007f70c54174a0 RDI: 0000000000000002 [ 101.971740][ T4524] RBP: 0000000000000000 R08: 0000000000000003 R09: 7abf98d885e43ab6 [ 101.979721][ T4524] R10: 0000000000004000 R11: 0000000000000206 R12: 00007f70c54174a0 executing program executing program executing program [ 101.987703][ T4524] R13: 00007f70c5407212 R14: 00007f70c5417666 R15: 00007f70c5417666 [ 101.995695][ T4524] executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 107.021916][ T4535] udevd[4535]: worker [5336] terminated by signal 33 (Unknown signal 33) [ 107.030971][ T4535] udevd[4535]: worker [5336] failed while handling '/devices/platform/regulatory.0' executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program