[ 68.451543][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 68.451561][ T43] audit: type=1400 audit(1789619393.261:209): avc: denied { transition } for pid=5975 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 68.451611][ T43] audit: type=1400 audit(1789619393.261:210): avc: denied { noatsecure } for pid=5975 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 68.451931][ T43] audit: type=1400 audit(1789619393.261:211): avc: denied { rlimitinh } for pid=5975 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 68.452101][ T43] audit: type=1400 audit(1789619393.261:212): avc: denied { siginh } for pid=5975 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.470261][ T43] audit: type=1400 audit(1789619396.281:213): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.532825][ T43] audit: type=1400 audit(1789619396.341:214): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.672390][ T43] audit: type=1400 audit(1789619396.481:215): avc: denied { write } for pid=5985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.724431][ T43] audit: type=1400 audit(1789619396.531:216): avc: denied { write } for pid=5988 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.777919][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.777955][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.879362][ T43] audit: type=1400 audit(1789619396.691:217): avc: denied { write } for pid=5991 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.943991][ T43] audit: type=1400 audit(1789619396.751:218): avc: denied { write } for pid=5994 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.795994][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 73.796010][ T43] audit: type=1400 audit(1789619398.611:223): avc: denied { write } for pid=6013 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.833931][ T43] audit: type=1400 audit(1789619398.641:224): avc: denied { write } for pid=6016 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.901960][ T43] audit: type=1400 audit(1789619398.711:225): avc: denied { write } for pid=6019 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.949455][ T43] audit: type=1400 audit(1789619398.761:226): avc: denied { write } for pid=6022 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.662365][ T43] audit: type=1400 audit(1789619399.471:227): avc: denied { write } for pid=6029 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:40491' (ED25519) to the list of known hosts. [ 74.718261][ T43] audit: type=1400 audit(1789619399.531:228): avc: denied { write } for pid=6033 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.835226][ T43] audit: type=1400 audit(1789619399.641:229): avc: denied { write } for pid=6039 comm="syz-executor371" name="uinput" dev="devtmpfs" ino=941 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 74.841533][ T6039] input: Virtual Keyboard as /devices/virtual/input/input5 [ 74.845316][ T43] audit: type=1400 audit(1789619399.651:230): avc: denied { open } for pid=6039 comm="syz-executor371" path="/dev/uinput" dev="devtmpfs" ino=941 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 74.845467][ T43] audit: type=1400 audit(1789619399.651:231): avc: denied { ioctl } for pid=6039 comm="syz-executor371" path="/dev/uinput" dev="devtmpfs" ino=941 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 74.955657][ T5882] [ 74.956830][ T5882] ====================================================== [ 74.959870][ T5882] WARNING: possible circular locking dependency detected [ 74.962881][ T5882] syzkaller #0 Not tainted [ 74.964901][ T5882] ------------------------------------------------------ [ 74.968003][ T5882] kworker/1:4/5882 is trying to acquire lock: [ 74.970644][ T5882] ffff8880266862c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x25/0x1b0 [ 74.975113][ T5882] [ 74.975113][ T5882] but task is already holding lock: [ 74.978819][ T5882] ffff8880354460b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 [ 74.982570][ T5882] [ 74.982570][ T5882] which lock already depends on the new lock. [ 74.982570][ T5882] [ 74.986825][ T5882] [ 74.986825][ T5882] the existing dependency chain (in reverse order) is: [ 74.990442][ T5882] [ 74.990442][ T5882] -> #3 (&buf->lock){+.+.}-{4:4}: [ 74.993477][ T5882] lock_acquire+0x1d1/0x380 [ 74.995638][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 74.998005][ T5882] tty_buffer_flush+0x72/0x310 [ 75.000426][ T5882] tty_ldisc_flush+0x68/0xf0 [ 75.002584][ T5882] __do_SAK+0x368/0x480 [ 75.004390][ T5882] vc_SAK+0x7f/0x320 [ 75.006164][ T5882] process_one_work+0xac7/0x1b10 [ 75.008262][ T5882] worker_thread+0x5ef/0xe50 [ 75.009917][ T5882] kthread+0x373/0x450 [ 75.011436][ T5882] ret_from_fork+0x730/0xd60 [ 75.013067][ T5882] ret_from_fork_asm+0x1a/0x30 [ 75.014721][ T5882] [ 75.014721][ T5882] -> #2 (console_lock){+.+.}-{0:0}: [ 75.017080][ T5882] lock_acquire+0x1d1/0x380 [ 75.018510][ T5882] console_lock+0x7a/0xa0 [ 75.020293][ T5882] serial_core_register_port+0xf4a/0x1660 [ 75.022388][ T5882] serial8250_register_8250_port+0x16c7/0x2440 [ 75.024585][ T5882] serial_pnp_probe+0x443/0x950 [ 75.026441][ T5882] pnp_device_probe+0x2b3/0x4a0 [ 75.028279][ T5882] really_probe+0x241/0xa60 [ 75.029937][ T5882] __driver_probe_device+0x210/0x460 [ 75.031926][ T5882] driver_probe_device+0x4a/0x140 [ 75.033760][ T5882] __driver_attach+0x21f/0x5b0 [ 75.035541][ T5882] bus_for_each_dev+0x13e/0x1d0 [ 75.037558][ T5882] bus_add_driver+0x305/0x5b0 [ 75.039725][ T5882] driver_register+0x1e2/0x360 [ 75.041765][ T5882] serial8250_init+0xcc/0x1c0 [ 75.043821][ T5882] do_one_initcall+0x11c/0x6f0 [ 75.045486][ T5882] kernel_init_freeable+0x6ea/0x7b0 [ 75.047315][ T5882] kernel_init+0x21/0x1e0 [ 75.048838][ T5882] ret_from_fork+0x730/0xd60 [ 75.050475][ T5882] ret_from_fork_asm+0x1a/0x30 [ 75.052581][ T5882] [ 75.052581][ T5882] -> #1 (&port->mutex){+.+.}-{4:4}: [ 75.055089][ T5882] lock_acquire+0x1d1/0x380 [ 75.056807][ T5882] __mutex_lock+0x1a4/0x1bd0 [ 75.058455][ T5882] uart_set_termios+0x8e/0x690 [ 75.060090][ T5882] tty_set_termios+0x64d/0x980 [ 75.061951][ T5882] set_termios+0x5c8/0x880 [ 75.063800][ T5882] tty_mode_ioctl+0x17e/0xd40 [ 75.065470][ T5882] n_tty_ioctl_helper+0x47/0x2b0 [ 75.067350][ T5882] n_tty_ioctl+0x53/0x340 [ 75.069053][ T5882] tty_ioctl+0x11b4/0x1640 [ 75.070814][ T5882] __x64_sys_ioctl+0x18e/0x210 [ 75.072711][ T5882] do_syscall_64+0x123/0x790 [ 75.074923][ T5882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.077028][ T5882] [ 75.077028][ T5882] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 75.079424][ T5882] check_prev_add+0xeb/0xe60 [ 75.081042][ T5882] __lock_acquire+0x1528/0x1f40 [ 75.082725][ T5882] lock_acquire+0x1d1/0x380 [ 75.084688][ T5882] down_write+0x8b/0x1f0 [ 75.086211][ T5882] n_tty_flush_buffer+0x25/0x1b0 [ 75.087948][ T5882] tty_buffer_flush+0x239/0x310 [ 75.089636][ T5882] tty_ldisc_flush+0x68/0xf0 [ 75.091237][ T5882] __do_SAK+0x368/0x480 [ 75.092772][ T5882] vc_SAK+0x7f/0x320 [ 75.094531][ T5882] process_one_work+0xac7/0x1b10 [ 75.096239][ T5882] worker_thread+0x5ef/0xe50 [ 75.097888][ T5882] kthread+0x373/0x450 [ 75.099349][ T5882] ret_from_fork+0x730/0xd60 [ 75.100967][ T5882] ret_from_fork_asm+0x1a/0x30 [ 75.102813][ T5882] [ 75.102813][ T5882] other info that might help us debug this: [ 75.102813][ T5882] [ 75.106496][ T5882] Chain exists of: [ 75.106496][ T5882] &tty->termios_rwsem --> console_lock --> &buf->lock [ 75.106496][ T5882] [ 75.110528][ T5882] Possible unsafe locking scenario: [ 75.110528][ T5882] [ 75.112857][ T5882] CPU0 CPU1 [ 75.114574][ T5882] ---- ---- [ 75.116596][ T5882] lock(&buf->lock); [ 75.117795][ T5882] lock(console_lock); [ 75.119853][ T5882] lock(&buf->lock); [ 75.121881][ T5882] lock(&tty->termios_rwsem); [ 75.123401][ T5882] [ 75.123401][ T5882] *** DEADLOCK *** [ 75.123401][ T5882] [ 75.126110][ T5882] locks held by kworker/1:4/5882: 5, last CPU#1: [ 75.128855][ T5882] #0: ffff88801c0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 75.133801][ T5882] #1: ffffc90003d37d08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 75.137838][ T5882] #2: ffffffff8edd8740 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 [ 75.140957][ T5882] #3: ffff8880266860a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 [ 75.144386][ T5882] #4: ffff8880354460b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 [ 75.147249][ T5882] [ 75.147249][ T5882] stack backtrace: [ 75.149156][ T5882] CPU: 1 UID: 0 PID: 5882 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 75.152187][ T5882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.156177][ T5882] Workqueue: events vc_SAK [ 75.157771][ T5882] Call Trace: [ 75.159176][ T5882] [ 75.160320][ T5882] dump_stack_lvl+0x100/0x190 [ 75.161808][ T5882] print_circular_bug.cold+0x178/0x1be [ 75.163773][ T5882] check_noncircular+0x146/0x160 [ 75.165732][ T5882] check_prev_add+0xeb/0xe60 [ 75.167320][ T5882] __lock_acquire+0x1528/0x1f40 [ 75.169143][ T5882] lock_acquire+0x1d1/0x380 [ 75.170813][ T5882] ? n_tty_flush_buffer+0x25/0x1b0 [ 75.172687][ T5882] ? __pfx___might_resched+0x10/0x10 [ 75.174629][ T5882] down_write+0x8b/0x1f0 [ 75.176232][ T5882] ? n_tty_flush_buffer+0x25/0x1b0 [ 75.178375][ T5882] ? __pfx_down_write+0x10/0x10 [ 75.180081][ T5882] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.181853][ T5882] n_tty_flush_buffer+0x25/0x1b0 [ 75.183426][ T5882] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.185196][ T5882] tty_buffer_flush+0x239/0x310 [ 75.186751][ T5882] tty_ldisc_flush+0x68/0xf0 [ 75.188356][ T5882] __do_SAK+0x368/0x480 [ 75.189934][ T5882] ? mark_held_locks+0x40/0x70 [ 75.191424][ T5882] vc_SAK+0x7f/0x320 [ 75.192696][ T5882] process_one_work+0xac7/0x1b10 [ 75.194258][ T5882] ? __pfx_process_one_work+0x10/0x10 [ 75.195934][ T5882] ? lock_acquire+0x1d1/0x380 [ 75.197461][ T5882] ? __pfx_vc_SAK+0x10/0x10 [ 75.199025][ T5882] worker_thread+0x5ef/0xe50 [ 75.200925][ T5882] ? __pfx_worker_thread+0x10/0x10 [ 75.202591][ T5882] ? kthread+0x13a/0x450 [ 75.204002][ T5882] ? __pfx_worker_thread+0x10/0x10 [ 75.205676][ T5882] kthread+0x373/0x450 [ 75.207039][ T5882] ? __pfx_kthread+0x10/0x10 [ 75.208595][ T5882] ret_from_fork+0x730/0xd60 [ 75.210107][ T5882] ? __pfx_ret_from_fork+0x10/0x10 [ 75.212219][ T5882] ? __switch_to+0x800/0x10f0 [ 75.213823][ T5882] ? __pfx_kthread+0x10/0x10 [ 75.215334][ T5882] ret_from_fork_asm+0x1a/0x30 [ 75.216948][ T5882] [+] Starting reproducer... [+] trigger_tcsets successful. [+] Child process for SAK killed by signal 9 (expected if SAK triggered). [-] TIOCSPTLCK failed: Inappropriate ioctl for device [-] trigger_pty failed to open /dev/pts/0: Input/output error [+] Reproducer finished. [ 75.218741][ T5882] tty tty5: SAK: killed process 6039 (syz-executor371): by fd#3 [ 76.896078][ T9] cfg80211: failed to load regulatory.db