[ 65.613922][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 65.613934][ T43] audit: type=1400 audit(1790431367.629:209): avc: denied { transition } for pid=5969 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.615291][ T43] audit: type=1400 audit(1790431367.629:210): avc: denied { noatsecure } for pid=5969 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.615318][ T43] audit: type=1400 audit(1790431367.629:211): avc: denied { rlimitinh } for pid=5969 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.615337][ T43] audit: type=1400 audit(1790431367.629:212): avc: denied { siginh } for pid=5969 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 69.417982][ T43] audit: type=1400 audit(1790431371.439:213): avc: denied { write } for pid=5977 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.467362][ T43] audit: type=1400 audit(1790431371.489:214): avc: denied { write } for pid=5980 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.564466][ T43] audit: type=1400 audit(1790431371.579:215): avc: denied { write } for pid=5983 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.604985][ T43] audit: type=1400 audit(1790431371.619:216): avc: denied { write } for pid=5986 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.876615][ T43] audit: type=1400 audit(1790431371.899:217): avc: denied { write } for pid=5989 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.921533][ T43] audit: type=1400 audit(1790431371.939:218): avc: denied { write } for pid=5992 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.916745][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 70.916761][ T43] audit: type=1400 audit(1790431372.939:221): avc: denied { write } for pid=6001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.968599][ T43] audit: type=1400 audit(1790431372.989:222): avc: denied { write } for pid=6004 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.044209][ T43] audit: type=1400 audit(1790431373.059:223): avc: denied { write } for pid=6007 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.102091][ T43] audit: type=1400 audit(1790431373.119:224): avc: denied { write } for pid=6011 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.193367][ T43] audit: type=1400 audit(1790431373.209:225): avc: denied { write } for pid=6016 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.227684][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.227729][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.242232][ T43] audit: type=1400 audit(1790431373.259:226): avc: denied { write } for pid=6020 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:17533' (ED25519) to the list of known hosts. [ 71.772503][ T43] audit: type=1400 audit(1790431373.789:227): avc: denied { write } for pid=6027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.824553][ T43] audit: type=1400 audit(1790431373.839:228): avc: denied { write } for pid=6030 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.502812][ T43] audit: type=1400 audit(1790431374.519:229): avc: denied { unlink } for pid=6026 comm="syz-executor25 ** replaying previous printk message ** [ 72.502812][ T43] audit: type=1400 audit(1790431374.519:229): avc: denied { unlink } for pid=6026 comm="syz-executor250" name="#1" dev="tmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 72.507685][ T43] audit: type=1400 audit(1790431374.529:230): avc: denied { mount } for pid=6026 comm="syz-executor250" name="/" dev="overlay" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 72.508990][ T6026] block2mtd: error: cannot open device /tmp/ovl_bug_BMnjfE/merged/nonexistent [ 72.510094][ T6026] [ 72.529187][ T6026] ====================================================== [ 72.531490][ T6026] WARNING: possible circular locking dependency detected [ 72.533778][ T6026] syzkaller #0 Not tainted [ 72.535196][ T6026] ------------------------------------------------------ [ 72.537553][ T6026] syz-executor250/6026 is trying to acquire lock: [ 72.539572][ T6026] ffff88803341a460 (sb_writers#6){.+.+}-{0:0}, at: ovl_create_object+0x130/0x3b0 [ 72.542730][ T6026] [ 72.542730][ T6026] but task is already holding lock: [ 72.545123][ T6026] ffff888048798160 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: lookup_open+0xb13/0x1990 [ 72.548382][ T6026] [ 72.548382][ T6026] which lock already depends on the new lock. [ 72.548382][ T6026] [ 72.551617][ T6026] [ 72.551617][ T6026] the existing dependency chain (in reverse order) is: [ 72.554498][ T6026] [ 72.554498][ T6026] -> #4 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}: [ 72.557240][ T6026] lock_acquire+0x1d1/0x380 [ 72.558812][ T6026] down_read+0x99/0x4c0 [ 72.560295][ T6026] lookup_slow+0x42/0x70 [ 72.561813][ T6026] path_lookupat+0x5e8/0xc40 [ 72.563469][ T6026] filename_lookup+0x202/0x590 [ 72.565454][ T6026] kern_path+0x37/0x50 [ 72.567043][ T6026] lookup_bdev+0xd8/0x2a0 [ 72.568609][ T6026] bdev_file_open_by_path+0x82/0x330 [ 72.570562][ T6026] block2mtd_setup2.isra.0+0x2ee/0xbd0 [ 72.572716][ T6026] block2mtd_setup+0xbd/0xd0 [ 72.574737][ T6026] param_attr_store+0x199/0x300 [ 72.576942][ T6026] module_attr_store+0x58/0x80 [ 72.579131][ T6026] sysfs_kf_write+0xf2/0x150 [ 72.581045][ T6026] kernfs_fop_write_iter+0x3e0/0x5f0 [ 72.583226][ T6026] iter_file_splice_write+0x830/0x10b0 [ 72.585463][ T6026] do_splice+0x109c/0x1fa0 [ 72.587377][ T6026] __do_splice+0x33b/0x370 [ 72.589210][ T6026] __x64_sys_splice+0x187/0x250 [ 72.591185][ T6026] do_syscall_64+0x123/0x790 [ 72.593183][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.595521][ T6026] [ 72.595521][ T6026] -> #3 (param_lock){+.+.}-{4:4}: [ 72.598161][ T6026] lock_acquire+0x1d1/0x380 [ 72.600005][ T6026] __mutex_lock+0x1a4/0x1bd0 [ 72.601872][ T6026] param_attr_store+0xec/0x300 [ 72.603800][ T6026] module_attr_store+0x58/0x80 [ 72.605745][ T6026] sysfs_kf_write+0xf2/0x150 [ 72.607625][ T6026] kernfs_fop_write_iter+0x3e0/0x5f0 [ 72.609749][ T6026] vfs_write+0x6af/0x1050 [ 72.611467][ T6026] ksys_write+0x12a/0x250 [ 72.613272][ T6026] do_syscall_64+0x123/0x790 [ 72.615136][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.617461][ T6026] [ 72.617461][ T6026] -> #2 (&of->mutex){+.+.}-{4:4}: [ 72.620066][ T6026] lock_acquire+0x1d1/0x380 [ 72.621906][ T6026] __mutex_lock+0x1a4/0x1bd0 [ 72.623797][ T6026] kernfs_fop_write_iter+0x2c2/0x5f0 [ 72.625876][ T6026] iter_file_splice_write+0x830/0x10b0 [ 72.627784][ T6026] do_splice+0x109c/0x1fa0 [ 72.629365][ T6026] __do_splice+0x33b/0x370 [ 72.630911][ T6026] __x64_sys_splice+0x187/0x250 [ 72.632596][ T6026] do_syscall_64+0x123/0x790 [ 72.634332][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.637192][ T6026] [ 72.637192][ T6026] -> #1 (&pipe->mutex){+.+.}-{4:4}: [ 72.639499][ T6026] lock_acquire+0x1d1/0x380 [ 72.641081][ T6026] __mutex_lock+0x1a4/0x1bd0 [ 72.642692][ T6026] pipe_lock+0x69/0x80 [ 72.644152][ T6026] iter_file_splice_write+0x1fd/0x10b0 [ 72.646075][ T6026] do_splice+0x109c/0x1fa0 [ 72.647663][ T6026] __do_splice+0x33b/0x370 [ 72.649217][ T6026] __x64_sys_splice+0x187/0x250 [ 72.650924][ T6026] do_syscall_64+0x123/0x790 [ 72.652550][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.654581][ T6026] [ 72.654581][ T6026] -> #0 (sb_writers#6){.+.+}-{0:0}: [ 72.656938][ T6026] check_prev_add+0xeb/0xe60 [ 72.658551][ T6026] __lock_acquire+0x1528/0x1f40 [ 72.660243][ T6026] lock_acquire+0x1d1/0x380 [ 72.661838][ T6026] mnt_want_write+0x6f/0x420 [ 72.663459][ T6026] ovl_create_object+0x130/0x3b0 [ 72.665170][ T6026] lookup_open+0x1255/0x1990 [ 72.666803][ T6026] path_openat+0xa2c/0x2440 [ 72.668386][ T6026] do_file_open+0x20e/0x430 [ 72.669985][ T6026] do_sys_openat2+0x10f/0x1e0 [ 72.671614][ T6026] __x64_sys_openat+0x12d/0x210 [ 72.673312][ T6026] do_syscall_64+0x123/0x790 [ 72.674787][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.676921][ T6026] [ 72.676921][ T6026] other info that might help us debug this: [ 72.676921][ T6026] [ 72.680058][ T6026] Chain exists of: [ 72.680058][ T6026] sb_writers#6 --> param_lock --> &ovl_i_mutex_dir_key[depth] [ 72.680058][ T6026] [ 72.684194][ T6026] Possible unsafe locking scenario: [ 72.684194][ T6026] [ 72.686555][ T6026] CPU0 CPU1 [ 72.688222][ T6026] ---- ---- [ 72.689856][ T6026] lock(&ovl_i_mutex_dir_key[depth]); [ 72.691491][ T6026] lock(param_lock); [ 72.693497][ T6026] lock(&ovl_i_mutex_dir_key[depth]); [ 72.695907][ T6026] rlock(sb_writers#6); [ 72.697258][ T6026] [ 72.697258][ T6026] *** DEADLOCK *** [ 72.697258][ T6026] [ 72.699775][ T6026] locks held by syz-executor250/6026: 2, last CPU#3: [ 72.701847][ T6026] #0: ffff888058418460 (sb_writers#13){.+.+}-{0:0}, at: lookup_open+0x150/0x1990 [ 72.704621][ T6026] #1: ffff888048798160 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: lookup_open+0xb13/0x1990 [ 72.707696][ T6026] [ 72.707696][ T6026] stack backtrace: [ 72.709477][ T6026] CPU: 3 UID: 0 PID: 6026 Comm: syz-executor250 Not tainted syzkaller #0 PREEMPT(full) [ 72.712365][ T6026] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.715412][ T6026] Call Trace: [ 72.716431][ T6026] [ 72.717356][ T6026] dump_stack_lvl+0x100/0x190 [ 72.718792][ T6026] print_circular_bug.cold+0x178/0x1be [ 72.720427][ T6026] check_noncircular+0x146/0x160 [ 72.721920][ T6026] check_prev_add+0xeb/0xe60 [ 72.723347][ T6026] ? do_raw_spin_unlock+0x145/0x1e0 [ 72.724936][ T6026] __lock_acquire+0x1528/0x1f40 [ 72.726492][ T6026] ? ovl_lookup+0x58f/0x6b0 [ 72.727859][ T6026] lock_acquire+0x1d1/0x380 [ 72.729220][ T6026] ? ovl_create_object+0x130/0x3b0 [ 72.730796][ T6026] ? __pfx___might_resched+0x10/0x10 [ 72.732385][ T6026] ? ovl_already_copied_up+0x10d/0x1c0 [ 72.734047][ T6026] mnt_want_write+0x6f/0x420 [ 72.735459][ T6026] ? ovl_create_object+0x130/0x3b0 [ 72.737024][ T6026] ovl_create_object+0x130/0x3b0 [ 72.738518][ T6026] ? __pfx_ovl_create_object+0x10/0x10 [ 72.740140][ T6026] ? bpf_lsm_inode_create+0x9/0x10 [ 72.741707][ T6026] ? security_inode_create+0xc4/0x280 [ 72.743718][ T6026] ? may_o_create+0x46/0x3a0 [ 72.745408][ T6026] ? __pfx_ovl_create+0x10/0x10 [ 72.747078][ T6026] lookup_open+0x1255/0x1990 [ 72.748546][ T6026] path_openat+0xa2c/0x2440 [ 72.750230][ T6026] ? __pfx_path_openat+0x10/0x10 [ 72.751769][ T6026] do_file_open+0x20e/0x430 [ 72.753152][ T6026] ? __pfx_do_file_open+0x10/0x10 [ 72.754722][ T6026] ? _raw_spin_unlock+0x28/0x50 [ 72.756209][ T6026] ? alloc_fd+0x471/0x7a0 [ 72.757520][ T6026] do_sys_openat2+0x10f/0x1e0 [ 72.758945][ T6026] ? __pfx_do_sys_openat2+0x10/0x10 [ 72.760513][ T6026] ? __fput+0x692/0xb50 [ 72.761794][ T6026] __x64_sys_openat+0x12d/0x210 [ 72.763258][ T6026] ? __pfx___x64_sys_openat+0x10/0x10 [ 72.765070][ T6026] do_syscall_64+0x123/0x790 [ 72.766586][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.768494][ T6026] RIP: 0033:0x7f7d4e2bb437 [ 72.769846][ T6026] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 72.776079][ T6026] RSP: 002b:00007ffeea51f4a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 72.779111][ T6026] RAX: ffffffffffffffda RBX: 000055556bba5400 RCX: 00007f7d4e2bb437 [ 72.781754][ T6026] RDX: 0000000000000042 RSI: 00007f7d4e2f4192 RDI: ffffffffffffff9c [ 72.784310][ T6026] RBP: 00007f7d4e2f40fe R08: 0000000000000000 R09: 0000000000000000 [ 72.786817][ T6026] R10: 00000000000001a4 R11: 0000000000000202 R12: 000055556bba7770 [ 72.789148][ T6026] R13: 0000000000000026 R14: 00007ffeea51f570 R15: 0000000000000002 [ 72.791512][ T6026] [+] Setup working directory. [+] Mounted overlayfs. [+] Established sb_writers -> pipe->mutex. [+] Established pipe->mutex -> param_lock -> ovl_i_mutex_dir_key. [+] Triggered ovl_i_mutex_dir_key -> sb_writers. [+] Done. [ 76.345819][ T1039] cfg80211: failed to load regulatory.db