[ 66.027956][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 66.027967][ T43] audit: type=1400 audit(1790306762.241:212): avc: denied { transition } for pid=5976 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 66.028572][ T43] audit: type=1400 audit(1790306762.241:213): avc: denied { noatsecure } for pid=5976 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 66.028719][ T43] audit: type=1400 audit(1790306762.251:214): avc: denied { rlimitinh } for pid=5976 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 66.028811][ T43] audit: type=1400 audit(1790306762.251:215): avc: denied { siginh } for pid=5976 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 67.673331][ T43] audit: type=1400 audit(1790306763.891:216): avc: denied { write } for pid=5981 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 67.749311][ T43] audit: type=1400 audit(1790306763.971:217): avc: denied { write } for pid=5984 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.916515][ T43] audit: type=1400 audit(1790306765.131:218): avc: denied { write } for pid=5987 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.960664][ T43] audit: type=1400 audit(1790306765.181:219): avc: denied { write } for pid=5990 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.957035][ T43] audit: type=1400 audit(1790306766.171:220): avc: denied { write } for pid=5997 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.020592][ T43] audit: type=1400 audit(1790306766.241:221): avc: denied { write } for pid=6000 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.387327][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 71.387340][ T43] audit: type=1400 audit(1790306767.601:224): avc: denied { write } for pid=6009 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.435478][ T43] audit: type=1400 audit(1790306767.651:225): avc: denied { write } for pid=6012 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.471904][ T1444] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.471991][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.539535][ T43] audit: type=1400 audit(1790306767.761:226): avc: denied { write } for pid=6015 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.590603][ T43] audit: type=1400 audit(1790306767.811:227): avc: denied { write } for pid=6019 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.695898][ T43] audit: type=1400 audit(1790306767.911:228): avc: denied { write } for pid=6025 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.746398][ T43] audit: type=1400 audit(1790306767.961:229): avc: denied { write } for pid=6028 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.834907][ T43] audit: type=1400 audit(1790306768.051:230): avc: denied { write } for pid=6031 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.904964][ T43] audit: type=1400 audit(1790306768.121:231): avc: denied { write } for pid=6034 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:1502' (ED25519) to the list of known hosts. [ 72.046924][ T43] audit: type=1400 audit(1790306768.261:232): avc: denied { mounton } for pid=6040 comm="syz-executor364" path="/sys/kernel/config" dev="configfs" ino=1075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 72.047443][ T43] audit: type=1400 audit(1790306768.261:233): avc: denied { mount } for pid=6040 comm="syz-executor364" name="/" dev="configfs" ino=1075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 72.067519][ T6040] [ 72.068376][ T6040] ====================================================== [ 72.070764][ T6040] WARNING: possible circular locking dependency detected [ 72.073100][ T6040] syzkaller #0 Not tainted [ 72.074778][ T6040] ------------------------------------------------------ [ 72.077170][ T6040] syz-executor364/6040 is trying to acquire lock: [ 72.079390][ T6040] ffff888029bd1b70 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950 [ 72.082324][ T6040] [ 72.082324][ T6040] but task is already holding lock: [ 72.084618][ T6040] ffff8880474c4d40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 72.087618][ T6040] [ 72.087618][ T6040] which lock already depends on the new lock. [ 72.087618][ T6040] [ 72.091596][ T6040] [ 72.091596][ T6040] the existing dependency chain (in reverse order) is: [ 72.094388][ T6040] [ 72.094388][ T6040] -> #4 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 72.097184][ T6040] lock_acquire+0x1d1/0x380 [ 72.099266][ T6040] down_write+0x8b/0x1f0 [ 72.101110][ T6040] configfs_depend_item_unlocked+0xf3/0x6a0 [ 72.103669][ T6040] usbg_make_tpg+0x251/0x610 [ 72.105684][ T6040] target_fabric_make_tpg+0xab/0x8c0 [ 72.108042][ T6040] configfs_mkdir+0x525/0xd40 [ 72.109769][ T6040] vfs_mkdir+0x364/0x850 [ 72.111274][ T6040] filename_mkdirat+0x48b/0x5e0 [ 72.112948][ T6040] __x64_sys_mkdir+0x6b/0x90 [ 72.114563][ T6040] do_syscall_64+0x123/0x790 [ 72.116164][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.118141][ T6040] [ 72.118141][ T6040] -> #3 (tpg_instances_lock){+.+.}-{4:4}: [ 72.120670][ T6040] lock_acquire+0x1d1/0x380 [ 72.122249][ T6040] __mutex_lock+0x1a4/0x1bd0 [ 72.123852][ T6040] tcm_alloc_inst+0x5f/0x1e0 [ 72.125448][ T6040] try_get_usb_function_instance+0x136/0x1f0 [ 72.127521][ T6040] usb_get_function_instance+0x16/0x70 [ 72.129810][ T6040] function_make+0x18c/0x3f0 [ 72.131424][ T6040] configfs_mkdir+0x525/0xd40 [ 72.133028][ T6040] vfs_mkdir+0x364/0x850 [ 72.134549][ T6040] filename_mkdirat+0x48b/0x5e0 [ 72.136240][ T6040] __x64_sys_mkdir+0x6b/0x90 [ 72.137842][ T6040] do_syscall_64+0x123/0x790 [ 72.139639][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.141626][ T6040] [ 72.141626][ T6040] -> #2 (func_lock){+.+.}-{4:4}: [ 72.143824][ T6040] lock_acquire+0x1d1/0x380 [ 72.145401][ T6040] __mutex_lock+0x1a4/0x1bd0 [ 72.147011][ T6040] try_get_usb_function_instance+0x26/0x1f0 [ 72.149223][ T6040] usb_get_function_instance+0x16/0x70 [ 72.151508][ T6040] function_make+0x18c/0x3f0 [ 72.153106][ T6040] configfs_mkdir+0x525/0xd40 [ 72.154920][ T6040] vfs_mkdir+0x364/0x850 [ 72.156543][ T6040] filename_mkdirat+0x48b/0x5e0 [ 72.158432][ T6040] __x64_sys_mkdir+0x6b/0x90 [ 72.160389][ T6040] do_syscall_64+0x123/0x790 [ 72.162242][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.164704][ T6040] [ 72.164704][ T6040] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 72.167934][ T6040] lock_acquire+0x1d1/0x380 [ 72.170066][ T6040] __mutex_lock+0x1a4/0x1bd0 [ 72.172128][ T6040] uvcg_extension_ba_source_id_store+0xdb/0x430 [ 72.174886][ T6040] configfs_write_iter+0x302/0x4e0 [ 72.177033][ T6040] vfs_write+0x6af/0x1050 [ 72.178597][ T6040] ksys_write+0x12a/0x250 [ 72.180376][ T6040] do_syscall_64+0x123/0x790 [ 72.182268][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.184774][ T6040] [ 72.184774][ T6040] -> #0 (&p->frag_sem){++++}-{4:4}: [ 72.187248][ T6040] check_prev_add+0xeb/0xe60 [ 72.189258][ T6040] __lock_acquire+0x1528/0x1f40 [ 72.191322][ T6040] lock_acquire+0x1d1/0x380 [ 72.192964][ T6040] down_write_killable+0x93/0x240 [ 72.194725][ T6040] configfs_rmdir+0x3fa/0x950 [ 72.196353][ T6040] vfs_rmdir+0x328/0x8a0 [ 72.197859][ T6040] filename_rmdir+0x31a/0x5c0 [ 72.199510][ T6040] __x64_sys_rmdir+0x46/0x70 [ 72.201116][ T6040] do_syscall_64+0x123/0x790 [ 72.202749][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.205202][ T6040] [ 72.205202][ T6040] other info that might help us debug this: [ 72.205202][ T6040] [ 72.209121][ T6040] Chain exists of: [ 72.209121][ T6040] &p->frag_sem --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 72.209121][ T6040] [ 72.214478][ T6040] Possible unsafe locking scenario: [ 72.214478][ T6040] [ 72.217416][ T6040] CPU0 CPU1 [ 72.219531][ T6040] ---- ---- [ 72.221631][ T6040] lock(&sb->s_type->i_mutex_key#24); [ 72.223816][ T6040] lock(tpg_instances_lock); [ 72.226625][ T6040] lock(&sb->s_type->i_mutex_key#24); [ 72.229784][ T6040] lock(&p->frag_sem); [ 72.231528][ T6040] [ 72.231528][ T6040] *** DEADLOCK *** [ 72.231528][ T6040] [ 72.234620][ T6040] locks held by syz-executor364/6040: 3, last CPU#3: [ 72.237276][ T6040] #0: ffff888023a04460 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 72.241063][ T6040] #1: ffff8880206a4d40 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 72.245030][ T6040] #2: ffff8880474c4d40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 72.248146][ T6040] [ 72.248146][ T6040] stack backtrace: [ 72.249993][ T6040] CPU: 3 UID: 0 PID: 6040 Comm: syz-executor364 Not tainted syzkaller #0 PREEMPT(full) [ 72.253010][ T6040] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.256177][ T6040] Call Trace: [ 72.257265][ T6040] [ 72.258218][ T6040] dump_stack_lvl+0x100/0x190 [ 72.259718][ T6040] print_circular_bug.cold+0x178/0x1be [ 72.261427][ T6040] check_noncircular+0x146/0x160 [ 72.262967][ T6040] check_prev_add+0xeb/0xe60 [ 72.264680][ T6040] __lock_acquire+0x1528/0x1f40 [ 72.266629][ T6040] lock_acquire+0x1d1/0x380 [ 72.268339][ T6040] ? configfs_rmdir+0x3fa/0x950 [ 72.269950][ T6040] ? __pfx___might_resched+0x10/0x10 [ 72.271629][ T6040] down_write_killable+0x93/0x240 [ 72.273254][ T6040] ? configfs_rmdir+0x3fa/0x950 [ 72.274790][ T6040] ? __pfx_down_write_killable+0x10/0x10 [ 72.276567][ T6040] ? configfs_rmdir+0x3be/0x950 [ 72.278092][ T6040] configfs_rmdir+0x3fa/0x950 [ 72.279623][ T6040] ? __pfx_configfs_rmdir+0x10/0x10 [ 72.281317][ T6040] ? __pfx_down_write+0x10/0x10 [ 72.282881][ T6040] vfs_rmdir+0x328/0x8a0 [ 72.284254][ T6040] filename_rmdir+0x31a/0x5c0 [ 72.285764][ T6040] ? __pfx_filename_rmdir+0x10/0x10 [ 72.287543][ T6040] ? do_getname+0x191/0x390 [ 72.289108][ T6040] __x64_sys_rmdir+0x46/0x70 [ 72.290923][ T6040] do_syscall_64+0x123/0x790 [ 72.292540][ T6040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.294929][ T6040] RIP: 0033:0x7f8c8d0d5d67 [ 72.296731][ T6040] Code: 00 00 90 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 00 31 c9 e8 ba 05 02 00 48 83 c4 18 c3 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 72.303012][ T6040] RSP: 002b:00007ffe6a0f49c8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054 [ 72.306397][ T6040] RAX: ffffffffffffffda RBX: 00007f8c8d131480 RCX: 00007f8c8d0d5d67 [ 72.308887][ T6040] RDX: 0000000000000000 RSI: 00007f8c8d15e320 RDI: 00007f8c8d131480 [ 72.311381][ T6040] RBP: 00007f8c8d131358 R08: 0000000000000000 R09: 00000000ffffffff [ 72.313785][ T6040] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f8c8d1313d8 [ 72.316267][ T6040] R13: 00007f8c8d131480 R14: 00007f8c8d159cc0 R15: 0000000000000002 [ 72.318939][ T6040] [+] configfs mounted. [+] mkdir /sys/kernel/config/usb_gadget/g1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/tcm.0 successful. [+] mkdir /sys/kernel/config/target/usb_gadget successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.6001405000000000 successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.6001405000000000/tpgt_1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/extensions/ext1 successful. [+] write to /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/extensions/ext1/baSourceID successful. [+] mkdir /sys/kernel/config/usb_gadget/g2 successful. [+] rmdir /sys/kernel/config/usb_gadget/g2 successful. [+] rmdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/extensions/ext1 successful. [+] rmdir /sys/kernel/config/target/usb_gadget/naa.6001405000000000/tpgt_1 successful. [+] rmdir /sys/kernel/config/usb_gadget/g1/functions/tcm.0 successful. [+] All steps completed successfully. [ 76.588724][ T1358] cfg80211: failed to load regulatory.db