[ 71.793411][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 71.793424][ T43] audit: type=1400 audit(1786621730.553:209): avc: denied { transition } for pid=5970 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.803308][ T43] audit: type=1400 audit(1786621730.573:210): avc: denied { noatsecure } for pid=5970 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.811407][ T43] audit: type=1400 audit(1786621730.573:211): avc: denied { rlimitinh } for pid=5970 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.818874][ T43] audit: type=1400 audit(1786621730.573:212): avc: denied { siginh } for pid=5970 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 74.709698][ T43] audit: type=1400 audit(1786621733.463:213): avc: denied { write } for pid=5975 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.774879][ T43] audit: type=1400 audit(1786621733.533:214): avc: denied { write } for pid=5978 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 74.974995][ T43] audit: type=1400 audit(1786621733.733:215): avc: denied { write } for pid=5981 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.035418][ T43] audit: type=1400 audit(1786621733.793:216): avc: denied { write } for pid=5984 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.411532][ T43] audit: type=1400 audit(1786621734.173:217): avc: denied { write } for pid=5988 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.463327][ T43] audit: type=1400 audit(1786621734.223:218): avc: denied { write } for pid=5992 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:24677' (ED25519) to the list of known hosts. [ 77.571634][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 77.571659][ T43] audit: type=1400 audit(1786621736.333:221): avc: denied { write } for pid=6009 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.608507][ T43] audit: type=1400 audit(1786621736.363:222): avc: denied { mounton } for pid=6012 comm="syz-executor188" path="/sys/kernel/config" dev="configfs" ino=2092 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.617617][ T6012] [ 77.618555][ T43] audit: type=1400 audit(1786621736.363:223): avc: denied { mount } for pid=6012 comm="syz-executor188" name="/" dev="configfs" ino=2092 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 77.619319][ T6012] ====================================================== [ 77.629078][ T43] audit: type=1400 audit(1786621736.363:224): avc: denied { search } for pid=6012 comm="syz-executor188" name="/" dev="configfs" ino=2092 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.631006][ T6012] WARNING: possible circular locking dependency detected [ 77.631014][ T6012] syzkaller #0 Not tainted [ 77.631020][ T6012] ------------------------------------------------------ [ 77.631024][ T6012] syz-executor188/6012 is trying to acquire lock: [ 77.631030][ T6012] ffffffff901c9ee8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 77.631070][ T6012] [ 77.631070][ T6012] but task is already holding lock: [ 77.631074][ T6012] ffff888046135200 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4} [ 77.640367][ T43] audit: type=1400 audit(1786621736.363:225): avc: denied { search } for pid=6012 comm="syz-executor188" name="usb_gadget" dev="configfs" ino=3894 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.642505][ T6012] , at: vfs_rmdir+0xed/0x8a0 [ 77.644428][ T43] audit: type=1400 audit(1786621736.373:226): avc: denied { write search } for pid=6012 comm="syz-executor188" name="usb_gadget" dev="configfs" ino=3894 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.646605][ T6012] [ 77.646605][ T6012] which lock already depends on the new lock. [ 77.646605][ T6012] [ 77.646611][ T6012] [ 77.646611][ T6012] the existing dependency chain (in reverse order) is: [ 77.646615][ T6012] [ 77.646615][ T6012] -> #2 [ 77.649302][ T43] audit: type=1400 audit(1786621736.373:227): avc: denied { add_name } for pid=6012 comm="syz-executor188" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.652289][ T6012] (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 77.652310][ T6012] lock_acquire+0x1b9/0x370 [ 77.652326][ T6012] down_write+0x8b/0x1f0 [ 77.652342][ T6012] configfs_depend_item_unlocked+0xf3/0x6a0 [ 77.652358][ T6012] usbg_make_tpg+0x261/0x620 [ 77.652371][ T6012] target_fabric_make_tpg+0xab/0x8c0 [ 77.655434][ T43] audit: type=1400 audit(1786621736.373:228): avc: denied { create } for pid=6012 comm="syz-executor188" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 77.657741][ T6012] configfs_mkdir+0x51e/0xb70 [ 77.667314][ T43] audit: type=1400 audit(1786621736.373:229): avc: denied { search } for pid=6012 comm="syz-executor188" name="/" dev="configfs" ino=2092 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.668731][ T6012] vfs_mkdir+0x361/0x850 [ 77.678614][ T43] audit: type=1400 audit(1786621736.373:230): avc: denied { search } for pid=6012 comm="syz-executor188" name="usb_gadget" dev="configfs" ino=3894 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.681749][ T6012] filename_mkdirat+0x48b/0x5e0 [ 77.681767][ T6012] __x64_sys_mkdir+0x6b/0x90 [ 77.681779][ T6012] do_syscall_64+0x115/0x870 [ 77.681793][ T6012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.681806][ T6012] [ 77.681806][ T6012] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 77.736548][ T6012] lock_acquire+0x1b9/0x370 [ 77.738147][ T6012] __mutex_lock+0x1a4/0x1bd0 [ 77.739817][ T6012] tcm_set_name+0x29/0xb0 [ 77.741349][ T6012] function_make+0x21c/0x3f0 [ 77.742984][ T6012] configfs_mkdir+0x51e/0xb70 [ 77.744642][ T6012] vfs_mkdir+0x361/0x850 [ 77.746184][ T6012] filename_mkdirat+0x48b/0x5e0 [ 77.747882][ T6012] __x64_sys_mkdir+0x6b/0x90 [ 77.749553][ T6012] do_syscall_64+0x115/0x870 [ 77.751198][ T6012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.753219][ T6012] [ 77.753219][ T6012] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 77.755836][ T6012] check_prev_add+0xeb/0xe60 [ 77.757499][ T6012] __lock_acquire+0x136c/0x1a40 [ 77.759259][ T6012] lock_acquire+0x1b9/0x370 [ 77.760885][ T6012] __mutex_lock+0x1a4/0x1bd0 [ 77.762521][ T6012] configfs_rmdir+0x5ae/0x950 [ 77.764221][ T6012] vfs_rmdir+0x328/0x8a0 [ 77.765754][ T6012] filename_rmdir+0x31a/0x5c0 [ 77.767417][ T6012] __x64_sys_rmdir+0x46/0x70 [ 77.769066][ T6012] do_syscall_64+0x115/0x870 [ 77.770698][ T6012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.772726][ T6012] [ 77.772726][ T6012] other info that might help us debug this: [ 77.772726][ T6012] [ 77.775925][ T6012] Chain exists of: [ 77.775925][ T6012] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 77.775925][ T6012] [ 77.780515][ T6012] Possible unsafe locking scenario: [ 77.780515][ T6012] [ 77.782864][ T6012] CPU0 CPU1 [ 77.784556][ T6012] ---- ---- [ 77.786249][ T6012] lock(&sb->s_type->i_mutex_key#24); [ 77.788286][ T6012] lock(&opts->dep_lock); [ 77.790850][ T6012] lock(&sb->s_type->i_mutex_key#24); [ 77.793414][ T6012] lock(gadget_subsys.su_mutex); [ 77.795040][ T6012] [ 77.795040][ T6012] *** DEADLOCK *** [ 77.795040][ T6012] [ 77.797610][ T6012] 3 locks held by syz-executor188/6012: [ 77.799401][ T6012] #0: ffff888023e74450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 77.802368][ T6012] #1: ffff8880461c30c0 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 77.805931][ T6012] #2: ffff888046135200 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 77.809168][ T6012] [ 77.809168][ T6012] stack backtrace: [ 77.811023][ T6012] CPU: 3 UID: 0 PID: 6012 Comm: syz-executor188 Not tainted syzkaller #0 PREEMPT(full) [ 77.811038][ T6012] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.811057][ T6012] Call Trace: [ 77.811071][ T6012] [ 77.811076][ T6012] dump_stack_lvl+0x100/0x190 [ 77.811095][ T6012] print_circular_bug.cold+0x178/0x1c7 [ 77.811113][ T6012] check_noncircular+0x146/0x160 [ 77.811129][ T6012] check_prev_add+0xeb/0xe60 [ 77.811142][ T6012] ? __bfs+0x150/0x2a0 [ 77.811152][ T6012] __lock_acquire+0x136c/0x1a40 [ 77.811168][ T6012] lock_acquire+0x1b9/0x370 [ 77.811181][ T6012] ? configfs_rmdir+0x5ae/0x950 [ 77.811198][ T6012] ? __pfx___might_resched+0x10/0x10 [ 77.811212][ T6012] ? __lock_acquire+0x49f/0x1a40 [ 77.811226][ T6012] __mutex_lock+0x1a4/0x1bd0 [ 77.811242][ T6012] ? configfs_rmdir+0x5ae/0x950 [ 77.811257][ T6012] ? configfs_rmdir+0x5ae/0x950 [ 77.811273][ T6012] ? reacquire_held_locks+0xce/0x1e0 [ 77.811287][ T6012] ? __pfx___mutex_lock+0x10/0x10 [ 77.811302][ T6012] ? do_raw_spin_lock+0x128/0x260 [ 77.811317][ T6012] ? find_held_lock+0x2b/0x80 [ 77.811327][ T6012] ? fast_dput+0x2fe/0x6d0 [ 77.811343][ T6012] ? _raw_spin_unlock+0x28/0x50 [ 77.811355][ T6012] ? fast_dput+0x168/0x6d0 [ 77.811370][ T6012] ? configfs_rmdir+0x5ae/0x950 [ 77.811385][ T6012] configfs_rmdir+0x5ae/0x950 [ 77.811402][ T6012] ? __pfx_configfs_rmdir+0x10/0x10 [ 77.811417][ T6012] ? __pfx_down_write+0x10/0x10 [ 77.811434][ T6012] vfs_rmdir+0x328/0x8a0 [ 77.811450][ T6012] filename_rmdir+0x31a/0x5c0 [ 77.811463][ T6012] ? __pfx_filename_rmdir+0x10/0x10 [ 77.811478][ T6012] ? do_getname+0x191/0x390 [ 77.811492][ T6012] __x64_sys_rmdir+0x46/0x70 [ 77.811505][ T6012] do_syscall_64+0x115/0x870 [ 77.811522][ T6012] ? clear_bhb_loop+0x70/0xc0 [ 77.811539][ T6012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.811557][ T6012] RIP: 0033:0x7f4c08104e67 [ 77.811568][ T6012] Code: 00 00 90 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 00 31 c9 e8 ba 05 02 00 48 83 c4 18 c3 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 77.811579][ T6012] RSP: 002b:00007ffd1a3d70b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 77.811597][ T6012] RAX: ffffffffffffffda RBX: 00007f4c08160488 RCX: 00007f4c08104e67 [ 77.811604][ T6012] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f4c08160488 [ 77.811610][ T6012] RBP: 0000000000000001 R08: 00007f4c0818d7c0 R09: 0000000000000001 [ 77.811616][ T6012] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd1a3d71e8 [ 77.811622][ T6012] R13: 0000000000000002 R14: 00007f4c08188cc0 R15: 0000000000000002 [ 77.811631][ T6012] [+] configfs mounted or already mounted. [+] usb_gadget created. [+] tcm function created. [+] target fabric directory created. [+] target fabric WWN created. [+] tpgt created. [+] strings dir created and removed. [+] uvc function created. [+] iTerminal opened. [+] iTerminal read. [+] Reproducer finished. [ 81.691592][ T42] cfg80211: failed to load regulatory.db