[ 73.566596][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 73.566609][ T43] audit: type=1400 audit(1786531748.485:212): avc: denied { transition } for pid=5967 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 73.580763][ T43] audit: type=1400 audit(1786531748.495:213): avc: denied { noatsecure } for pid=5967 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 73.587976][ T43] audit: type=1400 audit(1786531748.495:214): avc: denied { rlimitinh } for pid=5967 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 73.594496][ T43] audit: type=1400 audit(1786531748.495:215): avc: denied { siginh } for pid=5967 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 77.438871][ T43] audit: type=1400 audit(1786531752.355:216): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.503110][ T43] audit: type=1400 audit(1786531752.425:217): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.623534][ T43] audit: type=1400 audit(1786531752.545:218): avc: denied { write } for pid=5978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.694972][ T43] audit: type=1400 audit(1786531752.615:219): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.788012][ T43] audit: type=1400 audit(1786531752.705:220): avc: denied { write } for pid=5986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.856633][ T43] audit: type=1400 audit(1786531752.775:221): avc: denied { write } for pid=5991 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.794739][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 78.794756][ T43] audit: type=1400 audit(1786531753.715:224): avc: denied { write } for pid=6000 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.863040][ T43] audit: type=1400 audit(1786531753.785:225): avc: denied { write } for pid=6003 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.967834][ T43] audit: type=1400 audit(1786531753.885:226): avc: denied { write } for pid=6006 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.019839][ T43] audit: type=1400 audit(1786531753.935:227): avc: denied { write } for pid=6009 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.117500][ T43] audit: type=1400 audit(1786531754.035:228): avc: denied { write } for pid=6012 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.182935][ T43] audit: type=1400 audit(1786531754.105:229): avc: denied { write } for pid=6015 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.425577][ T43] audit: type=1400 audit(1786531755.345:230): avc: denied { write } for pid=6018 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.477586][ T43] audit: type=1400 audit(1786531755.395:231): avc: denied { write } for pid=6023 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:43193' (ED25519) to the list of known hosts. [ 80.846316][ T43] audit: type=1400 audit(1786531755.765:232): avc: denied { search } for pid=6031 comm="syz-executor351" name="/" dev="configfs" ino=3104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 80.853509][ T43] audit: type=1400 audit(1786531755.775:233): avc: denied { search } for pid=6031 comm="syz-executor351" name="usb_gadget" dev="configfs" ino=2059 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 80.862004][ T6031] [ 80.862863][ T6031] ====================================================== [ 80.865769][ T6031] WARNING: possible circular locking dependency detected [ 80.868697][ T6031] syzkaller #0 Not tainted [ 80.870561][ T6031] ------------------------------------------------------ [ 80.873451][ T6031] syz-executor351/6031 is trying to acquire lock: [ 80.876084][ T6031] ffffffff901c9ee8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 80.880140][ T6031] [ 80.880140][ T6031] but task is already holding lock: [ 80.883168][ T6031] ffff888047ac5b80 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 80.887146][ T6031] [ 80.887146][ T6031] which lock already depends on the new lock. [ 80.887146][ T6031] [ 80.891360][ T6031] [ 80.891360][ T6031] the existing dependency chain (in reverse order) is: [ 80.894876][ T6031] [ 80.894876][ T6031] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 80.898209][ T6031] lock_acquire+0x1b9/0x370 [ 80.900332][ T6031] down_write+0x8b/0x1f0 [ 80.902367][ T6031] configfs_depend_item_unlocked+0xf3/0x6a0 [ 80.904927][ T6031] usbg_make_tpg+0x261/0x620 [ 80.907098][ T6031] target_fabric_make_tpg+0xab/0x8c0 [ 80.909559][ T6031] configfs_mkdir+0x51e/0xb70 [ 80.911751][ T6031] vfs_mkdir+0x361/0x850 [ 80.913800][ T6031] filename_mkdirat+0x48b/0x5e0 [ 80.916094][ T6031] __x64_sys_mkdir+0x6b/0x90 [ 80.918255][ T6031] do_syscall_64+0x115/0x870 [ 80.920408][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.923049][ T6031] [ 80.923049][ T6031] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 80.926197][ T6031] lock_acquire+0x1b9/0x370 [ 80.928381][ T6031] __mutex_lock+0x1a4/0x1bd0 [ 80.930527][ T6031] tcm_set_name+0x29/0xb0 [ 80.932567][ T6031] function_make+0x21c/0x3f0 [ 80.934710][ T6031] configfs_mkdir+0x51e/0xb70 [ 80.936833][ T6031] vfs_mkdir+0x361/0x850 [ 80.938858][ T6031] filename_mkdirat+0x48b/0x5e0 [ 80.941087][ T6031] __x64_sys_mkdir+0x6b/0x90 [ 80.943249][ T6031] do_syscall_64+0x115/0x870 [ 80.945462][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.948246][ T6031] [ 80.948246][ T6031] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 80.951637][ T6031] check_prev_add+0xeb/0xe60 [ 80.953754][ T6031] __lock_acquire+0x136c/0x1a40 [ 80.956016][ T6031] lock_acquire+0x1b9/0x370 [ 80.958156][ T6031] __mutex_lock+0x1a4/0x1bd0 [ 80.960326][ T6031] configfs_rmdir+0x5ae/0x950 [ 80.962431][ T6031] vfs_rmdir+0x328/0x8a0 [ 80.964458][ T6031] filename_rmdir+0x31a/0x5c0 [ 80.966476][ T6031] __x64_sys_rmdir+0x46/0x70 [ 80.968589][ T6031] do_syscall_64+0x115/0x870 [ 80.970748][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.973378][ T6031] [ 80.973378][ T6031] other info that might help us debug this: [ 80.973378][ T6031] [ 80.977599][ T6031] Chain exists of: [ 80.977599][ T6031] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 80.977599][ T6031] [ 80.983559][ T6031] Possible unsafe locking scenario: [ 80.983559][ T6031] [ 80.986616][ T6031] CPU0 CPU1 [ 80.988898][ T6031] ---- ---- [ 80.991140][ T6031] lock(&sb->s_type->i_mutex_key#24); [ 80.993308][ T6031] lock(&opts->dep_lock); [ 80.996165][ T6031] lock(&sb->s_type->i_mutex_key#24); [ 80.999455][ T6031] lock(gadget_subsys.su_mutex); [ 81.001570][ T6031] [ 81.001570][ T6031] *** DEADLOCK *** [ 81.001570][ T6031] [ 81.004895][ T6031] 3 locks held by syz-executor351/6031: [ 81.007153][ T6031] #0: ffff888023ea2450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 81.011015][ T6031] #1: ffff888020242740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 81.015652][ T6031] #2: ffff888047ac5b80 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 81.019890][ T6031] [ 81.019890][ T6031] stack backtrace: [ 81.022384][ T6031] CPU: 0 UID: 0 PID: 6031 Comm: syz-executor351 Not tainted syzkaller #0 PREEMPT(full) [ 81.022405][ T6031] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.022430][ T6031] Call Trace: [ 81.022447][ T6031] [ 81.022454][ T6031] dump_stack_lvl+0x100/0x190 [ 81.022477][ T6031] print_circular_bug.cold+0x178/0x1c7 [ 81.022506][ T6031] check_noncircular+0x146/0x160 [ 81.022529][ T6031] ? kasan_save_stack+0x30/0x50 [ 81.022551][ T6031] check_prev_add+0xeb/0xe60 [ 81.022576][ T6031] ? vfs_rmdir+0x328/0x8a0 [ 81.022599][ T6031] ? __x64_sys_rmdir+0x46/0x70 [ 81.022618][ T6031] __lock_acquire+0x136c/0x1a40 [ 81.022642][ T6031] lock_acquire+0x1b9/0x370 [ 81.022661][ T6031] ? configfs_rmdir+0x5ae/0x950 [ 81.022686][ T6031] ? __pfx___might_resched+0x10/0x10 [ 81.022708][ T6031] ? __lock_acquire+0x49f/0x1a40 [ 81.022725][ T6031] __mutex_lock+0x1a4/0x1bd0 [ 81.022750][ T6031] ? configfs_rmdir+0x5ae/0x950 [ 81.022772][ T6031] ? configfs_rmdir+0x5ae/0x950 [ 81.022795][ T6031] ? reacquire_held_locks+0xce/0x1e0 [ 81.022815][ T6031] ? __pfx___mutex_lock+0x10/0x10 [ 81.022835][ T6031] ? do_raw_spin_lock+0x128/0x260 [ 81.022859][ T6031] ? find_held_lock+0x2b/0x80 [ 81.022874][ T6031] ? fast_dput+0x2fe/0x6d0 [ 81.022899][ T6031] ? _raw_spin_unlock+0x28/0x50 [ 81.022916][ T6031] ? fast_dput+0x168/0x6d0 [ 81.022940][ T6031] ? configfs_rmdir+0x5ae/0x950 [ 81.022961][ T6031] configfs_rmdir+0x5ae/0x950 [ 81.022986][ T6031] ? __pfx_configfs_rmdir+0x10/0x10 [ 81.023008][ T6031] ? __pfx_down_write+0x10/0x10 [ 81.023034][ T6031] vfs_rmdir+0x328/0x8a0 [ 81.023058][ T6031] filename_rmdir+0x31a/0x5c0 [ 81.023078][ T6031] ? __pfx_filename_rmdir+0x10/0x10 [ 81.023099][ T6031] ? do_getname+0x191/0x390 [ 81.023121][ T6031] __x64_sys_rmdir+0x46/0x70 [ 81.023141][ T6031] do_syscall_64+0x115/0x870 [ 81.023163][ T6031] ? clear_bhb_loop+0x70/0xc0 [ 81.023181][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.023200][ T6031] RIP: 0033:0x7f7c99efbd27 [ 81.023214][ T6031] Code: 00 00 90 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 00 31 c9 e8 7a 05 02 00 48 83 c4 18 c3 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 81.023231][ T6031] RSP: 002b:00007ffd8d2c5ba8 EFLAGS: 00000206 ORIG_RAX: 0000000000000054 [ 81.023261][ T6031] RAX: ffffffffffffffda RBX: 00007f7c99f573f8 RCX: 00007f7c99efbd27 [ 81.023272][ T6031] RDX: 0000000000000000 RSI: 00007f7c99f84320 RDI: 00007f7c99f573f8 [ 81.023282][ T6031] RBP: 0000000000000001 R08: 00007f7c99f847c0 R09: 00000000ffffffff [ 81.023293][ T6031] R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffd8d2c5cd8 [ 81.023303][ T6031] R13: 0000000000000002 R14: 00007f7c99f7fcc0 R15: 0000000000000002 [ 81.023318][ T6031] [*] Starting reproducer... [*] Step 1: gadget_subsys.su_mutex -> opts->dep_lock [+] mkdir /sys/kernel/config/usb_gadget/g1 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/tcm.0 successful. [*] Step 2: opts->dep_lock -> inode_lock [+] mkdir /sys/kernel/config/target/usb_gadget successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.1234567890123456 successful. [+] mkdir /sys/kernel/config/target/usb_gadget/naa.1234567890123456/tpgt_1 successful. [*] Step 3: inode_lock -> frag_sem [+] mkdir /sys/kernel/config/usb_gadget/g2 successful. [+] rmdir /sys/kernel/config/usb_gadget/g2 successful. [*] Step 4: frag_sem -> gadget_subsys.su_mutex [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0 successful. [+] mkdir /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/extensions/ext1 successful. [+] write to /sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/extensions/ext1/bNumControls successful. [*] Done. [ 81.921282][ T3261] cfg80211: failed to load regulatory.db