[ 84.124966][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 84.127674][ T42] audit: type=1400 audit(1786534769.448:208): avc: denied { transition } for pid=5977 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.136667][ T42] audit: type=1400 audit(1786534769.448:209): avc: denied { noatsecure } for pid=5977 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.144748][ T42] audit: type=1400 audit(1786534769.458:210): avc: denied { rlimitinh } for pid=5977 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.152584][ T42] audit: type=1400 audit(1786534769.458:211): avc: denied { siginh } for pid=5977 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 86.654385][ T42] audit: type=1400 audit(1786534771.978:212): avc: denied { write } for pid=5981 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.723060][ T42] audit: type=1400 audit(1786534772.048:213): avc: denied { write } for pid=5984 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.776560][ T42] audit: type=1400 audit(1786534773.108:214): avc: denied { write } for pid=5987 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.827263][ T42] audit: type=1400 audit(1786534773.158:215): avc: denied { write } for pid=5990 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.944145][ T42] audit: type=1400 audit(1786534773.268:216): avc: denied { write } for pid=5993 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 88.018864][ T42] audit: type=1400 audit(1786534773.348:217): avc: denied { write } for pid=5996 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.183157][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 89.183178][ T42] audit: type=1400 audit(1786534774.508:222): avc: denied { write } for pid=6016 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.254776][ T42] audit: type=1400 audit(1786534774.578:223): avc: denied { write } for pid=6019 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.385257][ T42] audit: type=1400 audit(1786534774.708:224): avc: denied { write } for pid=6022 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.467311][ T42] audit: type=1400 audit(1786534774.798:225): avc: denied { write } for pid=6025 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.407876][ T42] audit: type=1400 audit(1786534775.738:226): avc: denied { write } for pid=6028 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.451906][ T42] audit: type=1400 audit(1786534775.778:227): avc: denied { write } for pid=6031 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:51584' (ED25519) to the list of known hosts. [ 91.070060][ T42] audit: type=1400 audit(1786534776.398:228): avc: denied { write } for pid=6042 comm="syz-executor183" name="uinput" dev="devtmpfs" ino=942 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 91.070356][ T42] audit: type=1400 audit(1786534776.398:229): avc: denied { open } for pid=6042 comm="syz-executor183" path="/dev/uinput" dev="devtmpfs" ino=942 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 91.070627][ T42] audit: type=1400 audit(1786534776.398:230): avc: denied { ioctl } for pid=6042 comm="syz-executor183" path="/dev/uinput" dev="devtmpfs" ino=942 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 91.074817][ T6042] input: Virtual Keyboard as /devices/virtual/input/input5 [ 91.181242][ T5859] [ 91.181259][ T5859] ====================================================== [ 91.181281][ T5859] WARNING: possible circular locking dependency detected [ 91.181290][ T5859] syzkaller #0 Not tainted [ 91.181308][ T5859] ------------------------------------------------------ [ 91.181315][ T5859] kworker/0:3/5859 is trying to acquire lock: [ 91.181327][ T5859] ffff88802daee2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x25/0x1b0 [ 91.181389][ T5859] [ 91.181389][ T5859] but task is already holding lock: [ 91.181395][ T5859] ffff888034e660b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 [ 91.181439][ T5859] [ 91.181439][ T5859] which lock already depends on the new lock. [ 91.181439][ T5859] [ 91.181445][ T5859] [ 91.181445][ T5859] the existing dependency chain (in reverse order) is: [ 91.181452][ T5859] [ 91.181452][ T5859] -> #3 (&buf->lock){+.+.}-{4:4}: [ 91.181478][ T5859] lock_acquire+0x1b9/0x370 [ 91.181533][ T5859] __mutex_lock+0x1a4/0x1bd0 [ 91.181560][ T5859] tty_buffer_flush+0x72/0x310 [ 91.181578][ T5859] tty_ldisc_flush+0x68/0xf0 [ 91.181594][ T5859] __do_SAK+0x368/0x480 [ 91.181615][ T5859] vc_SAK+0x7f/0x320 [ 91.181639][ T5859] process_one_work+0xa23/0x1940 [ 91.181659][ T5859] worker_thread+0x5ef/0xe50 [ 91.181678][ T5859] kthread+0x370/0x450 [ 91.181694][ T5859] ret_from_fork+0x72b/0xd50 [ 91.181720][ T5859] ret_from_fork_asm+0x1a/0x30 [ 91.181746][ T5859] [ 91.181746][ T5859] -> #2 (console_lock){+.+.}-{0:0}: [ 91.181771][ T5859] lock_acquire+0x1b9/0x370 [ 91.181792][ T5859] console_lock+0x7a/0xa0 [ 91.181813][ T5859] serial_core_register_port+0xe65/0x16f0 [ 91.181837][ T5859] serial8250_register_8250_port+0x15af/0x2330 [ 91.181856][ T5859] serial_pnp_probe+0x436/0x930 [ 91.181870][ T5859] pnp_device_probe+0x2b3/0x4a0 [ 91.181893][ T5859] really_probe+0x241/0xa60 [ 91.181914][ T5859] __driver_probe_device+0x20e/0x450 [ 91.181935][ T5859] driver_probe_device+0x4a/0x140 [ 91.181954][ T5859] __driver_attach+0x21f/0x5b0 [ 91.181974][ T5859] bus_for_each_dev+0x13e/0x1d0 [ 91.181989][ T5859] bus_add_driver+0x305/0x5b0 [ 91.182006][ T5859] driver_register+0x1e2/0x360 [ 91.182027][ T5859] serial8250_init+0xcc/0x1c0 [ 91.182054][ T5859] do_one_initcall+0x11d/0x700 [ 91.182075][ T5859] kernel_init_freeable+0x6ea/0x7b0 [ 91.182102][ T5859] kernel_init+0x1f/0x1e0 [ 91.182116][ T5859] ret_from_fork+0x72b/0xd50 [ 91.182138][ T5859] ret_from_fork_asm+0x1a/0x30 [ 91.182161][ T5859] [ 91.182161][ T5859] -> #1 (&port->mutex){+.+.}-{4:4}: [ 91.182185][ T5859] lock_acquire+0x1b9/0x370 [ 91.182205][ T5859] __mutex_lock+0x1a4/0x1bd0 [ 91.182224][ T5859] uart_set_termios+0x8e/0x690 [ 91.182244][ T5859] tty_set_termios+0x64d/0x980 [ 91.182267][ T5859] set_termios+0x5c8/0x880 [ 91.182281][ T5859] tty_mode_ioctl+0x17e/0xd40 [ 91.182302][ T5859] n_tty_ioctl_helper+0x47/0x2b0 [ 91.182318][ T5859] n_tty_ioctl+0x53/0x340 [ 91.182338][ T5859] tty_ioctl+0x11b4/0x1640 [ 91.182368][ T5859] __x64_sys_ioctl+0x18e/0x210 [ 91.182393][ T5859] do_syscall_64+0x115/0x870 [ 91.182414][ T5859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.182431][ T5859] [ 91.182431][ T5859] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 91.182459][ T5859] check_prev_add+0xeb/0xe60 [ 91.182479][ T5859] __lock_acquire+0x136c/0x1a40 [ 91.182500][ T5859] lock_acquire+0x1b9/0x370 [ 91.182519][ T5859] down_write+0x8b/0x1f0 [ 91.182540][ T5859] n_tty_flush_buffer+0x25/0x1b0 [ 91.182564][ T5859] tty_buffer_flush+0x239/0x310 [ 91.182583][ T5859] tty_ldisc_flush+0x68/0xf0 [ 91.182600][ T5859] __do_SAK+0x368/0x480 [ 91.182620][ T5859] vc_SAK+0x7f/0x320 [ 91.182641][ T5859] process_one_work+0xa23/0x1940 [ 91.182659][ T5859] worker_thread+0x5ef/0xe50 [ 91.182677][ T5859] kthread+0x370/0x450 [ 91.182692][ T5859] ret_from_fork+0x72b/0xd50 [ 91.182715][ T5859] ret_from_fork_asm+0x1a/0x30 [ 91.182739][ T5859] [ 91.182739][ T5859] other info that might help us debug this: [ 91.182739][ T5859] [ 91.182745][ T5859] Chain exists of: [ 91.182745][ T5859] &tty->termios_rwsem --> console_lock --> &buf->lock [ 91.182745][ T5859] [ 91.182775][ T5859] Possible unsafe locking scenario: [ 91.182775][ T5859] [ 91.182780][ T5859] CPU0 CPU1 [ 91.182785][ T5859] ---- ---- [ 91.182790][ T5859] lock(&buf->lock); [ 91.182801][ T5859] lock(console_lock); [ 91.182815][ T5859] lock(&buf->lock); [ 91.182828][ T5859] lock(&tty->termios_rwsem); [ 91.182840][ T5859] [ 91.182840][ T5859] *** DEADLOCK *** [ 91.182840][ T5859] [ 91.182844][ T5859] 5 locks held by kworker/0:3/5859: [ 91.182855][ T5859] #0: ffff88801bcaa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 91.182899][ T5859] #1: ffffc90003cc7d08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 91.182945][ T5859] #2: ffffffff8ebd45a0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 [ 91.182994][ T5859] #3: ffff88802daee0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 [ 91.183054][ T5859] #4: ffff888034e660b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 [ 91.183099][ T5859] [ 91.183099][ T5859] stack backtrace: [ 91.183123][ T5859] CPU: 0 UID: 0 PID: 5859 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 91.183143][ T5859] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.183155][ T5859] Workqueue: events vc_SAK [ 91.183179][ T5859] Call Trace: [ 91.183195][ T5859] [ 91.183203][ T5859] dump_stack_lvl+0x100/0x190 [ 91.183223][ T5859] print_circular_bug.cold+0x178/0x1c7 [ 91.183254][ T5859] check_noncircular+0x146/0x160 [ 91.183277][ T5859] check_prev_add+0xeb/0xe60 [ 91.183304][ T5859] __lock_acquire+0x136c/0x1a40 [ 91.183327][ T5859] lock_acquire+0x1b9/0x370 [ 91.183347][ T5859] ? n_tty_flush_buffer+0x25/0x1b0 [ 91.183372][ T5859] ? __pfx___might_resched+0x10/0x10 [ 91.183394][ T5859] down_write+0x8b/0x1f0 [ 91.183418][ T5859] ? n_tty_flush_buffer+0x25/0x1b0 [ 91.183442][ T5859] ? __pfx_down_write+0x10/0x10 [ 91.183466][ T5859] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 91.183490][ T5859] n_tty_flush_buffer+0x25/0x1b0 [ 91.183514][ T5859] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 91.183537][ T5859] tty_buffer_flush+0x239/0x310 [ 91.183558][ T5859] tty_ldisc_flush+0x68/0xf0 [ 91.183575][ T5859] __do_SAK+0x368/0x480 [ 91.183596][ T5859] ? mark_held_locks+0x40/0x70 [ 91.183616][ T5859] vc_SAK+0x7f/0x320 [ 91.183640][ T5859] process_one_work+0xa23/0x1940 [ 91.183662][ T5859] ? __pfx_process_one_work+0x10/0x10 [ 91.183684][ T5859] ? __pfx_vc_SAK+0x10/0x10 [ 91.183709][ T5859] worker_thread+0x5ef/0xe50 [ 91.183730][ T5859] ? __pfx_worker_thread+0x10/0x10 [ 91.183749][ T5859] ? kthread+0x13a/0x450 [ 91.183764][ T5859] ? __pfx_worker_thread+0x10/0x10 [ 91.183783][ T5859] kthread+0x370/0x450 [ 91.183798][ T5859] ? __pfx_kthread+0x10/0x10 [ 91.183816][ T5859] ret_from_fork+0x72b/0xd50 [ 91.183839][ T5859] ? __pfx_ret_from_fork+0x10/0x10 [ 91.183862][ T5859] ? __switch_to+0x800/0x10f0 [ 91.183881][ T5859] ? __pfx_kthread+0x10/0x10 [ 91.183897][ T5859] ret_from_fork_asm+0x1a/0x30 [ 91.183927][ T5859] [ 91.185157][ T5859] tty tty5: SAK: killed process 6042 (syz-executor183): by fd#3 [+] Starting reproducer... [+] trigger_tcsets successful. [+] Child process for SAK killed by signal 9 (expected if SAK triggered). [-] TIOCSPTLCK failed: Inappropriate ioctl for device [-] trigger_pty failed to open /dev/pts/0: Input/output error [+] Reproducer finished.