Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts. 2023/11/04 13:16:43 ignoring optional flag "sandboxArg"="0" 2023/11/04 13:16:44 parsed 1 programs [ 108.303424][ T27] kauditd_printk_skb: 74 callbacks suppressed [ 108.303439][ T27] audit: type=1400 audit(1699103804.258:203): avc: denied { getattr } for pid=5404 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 108.335348][ T27] audit: type=1400 audit(1699103804.258:204): avc: denied { read } for pid=5404 comm="syz-execprog" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 108.358203][ T27] audit: type=1400 audit(1699103804.258:205): avc: denied { open } for pid=5404 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 108.384619][ T27] audit: type=1400 audit(1699103804.338:206): avc: denied { mounton } for pid=5409 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 108.411266][ T27] audit: type=1400 audit(1699103804.338:207): avc: denied { mount } for pid=5409 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 108.436524][ T27] audit: type=1400 audit(1699103804.358:208): avc: denied { read write } for pid=5409 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 108.468602][ T27] audit: type=1400 audit(1699103804.358:209): avc: denied { open } for pid=5409 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 108.500339][ T27] audit: type=1400 audit(1699103804.448:210): avc: denied { unlink } for pid=5409 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 109.025972][ T27] audit: type=1400 audit(1699103804.978:211): avc: denied { relabelto } for pid=5411 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" 2023/11/04 13:16:46 executed programs: 0 [ 110.462161][ T5409] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 110.534608][ T4455] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 110.543363][ T4455] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 110.552234][ T4455] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 110.561828][ T4455] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 110.569682][ T4455] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 110.578370][ T4455] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 110.598663][ T27] audit: type=1400 audit(1699103806.548:212): avc: denied { mounton } for pid=5416 comm="syz-executor.0" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 110.762587][ T5416] chnl_net:caif_netlink_parms(): no params data found [ 110.843035][ T5416] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.850493][ T5416] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.858817][ T5416] bridge_slave_0: entered allmulticast mode [ 110.866344][ T5416] bridge_slave_0: entered promiscuous mode [ 110.875090][ T5416] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.882533][ T5416] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.889707][ T5416] bridge_slave_1: entered allmulticast mode [ 110.897037][ T5416] bridge_slave_1: entered promiscuous mode [ 110.931502][ T5416] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.944450][ T5416] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.983737][ T5416] team0: Port device team_slave_0 added [ 110.993500][ T5416] team0: Port device team_slave_1 added [ 111.025094][ T5416] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.033060][ T5416] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.062242][ T5416] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.075250][ T5416] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.082381][ T5416] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 111.109063][ T5416] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.159473][ T5416] hsr_slave_0: entered promiscuous mode [ 111.167284][ T5416] hsr_slave_1: entered promiscuous mode [ 112.132546][ T5416] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 112.148064][ T5416] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 112.164511][ T5416] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 112.179938][ T5416] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 112.331217][ T5416] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.368471][ T5416] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.387162][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.394463][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.423526][ T26] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.430975][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.643784][ T50] Bluetooth: hci0: command 0x0409 tx timeout [ 112.749734][ T5416] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 112.843435][ T5416] veth0_vlan: entered promiscuous mode [ 112.864745][ T5416] veth1_vlan: entered promiscuous mode [ 112.931338][ T5416] veth0_macvtap: entered promiscuous mode [ 112.944430][ T5416] veth1_macvtap: entered promiscuous mode [ 112.979141][ T5416] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.004357][ T5416] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.026529][ T5416] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.036440][ T5416] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.048650][ T5416] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.058170][ T5416] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.220839][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.229068][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.314929][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.325288][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.339933][ T27] audit: type=1400 audit(1699103809.288:213): avc: denied { mounton } for pid=5416 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=2323 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 113.478831][ T27] audit: type=1400 audit(1699103809.428:214): avc: denied { read write } for pid=5482 comm="syz-executor.0" name="virtual_nci" dev="devtmpfs" ino=683 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 113.504324][ T27] audit: type=1400 audit(1699103809.428:215): avc: denied { open } for pid=5482 comm="syz-executor.0" path="/dev/virtual_nci" dev="devtmpfs" ino=683 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 113.536558][ T5483] [ 113.538929][ T5483] ====================================================== [ 113.546044][ T5483] WARNING: possible circular locking dependency detected [ 113.553074][ T5483] 6.6.0-syzkaller-14142-g90b0c2b2edd1 #0 Not tainted [ 113.559848][ T5483] ------------------------------------------------------ [ 113.567150][ T5483] syz-executor.0/5483 is trying to acquire lock: [ 113.573578][ T5483] ffff88802947d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 [ 113.583024][ T5483] [ 113.583024][ T5483] but task is already holding lock: [ 113.590565][ T5483] ffffffff8ef22848 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x16e/0x570 [ 113.600708][ T5483] [ 113.600708][ T5483] which lock already depends on the new lock. [ 113.600708][ T5483] [ 113.611212][ T5483] [ 113.611212][ T5483] the existing dependency chain (in reverse order) is: [ 113.620331][ T5483] [ 113.620331][ T5483] -> #3 (rfkill_global_mutex){+.+.}-{3:3}: [ 113.628864][ T5483] __mutex_lock+0x181/0x1340 [ 113.634016][ T5483] rfkill_register+0x3a/0xb30 [ 113.639420][ T5483] hci_register_dev+0x43a/0xd40 [ 113.644825][ T5483] __vhci_create_device+0x393/0x800 [ 113.650667][ T5483] vhci_write+0x2c7/0x470 [ 113.655902][ T5483] vfs_write+0x64f/0xdf0 [ 113.661235][ T5483] ksys_write+0x12f/0x250 [ 113.666380][ T5483] do_syscall_64+0x3f/0x110 [ 113.671719][ T5483] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 113.678257][ T5483] [ 113.678257][ T5483] -> #2 (&data->open_mutex){+.+.}-{3:3}: [ 113.686716][ T5483] __mutex_lock+0x181/0x1340 [ 113.691958][ T5483] vhci_send_frame+0x67/0xa0 [ 113.697278][ T5483] hci_send_frame+0x220/0x470 [ 113.702499][ T5483] hci_tx_work+0x1456/0x1e40 [ 113.707733][ T5483] process_one_work+0x884/0x15c0 [ 113.713489][ T5483] worker_thread+0x8b9/0x1290 [ 113.718992][ T5483] kthread+0x33c/0x440 [ 113.723958][ T5483] ret_from_fork+0x45/0x80 [ 113.729447][ T5483] ret_from_fork_asm+0x11/0x20 [ 113.734939][ T5483] [ 113.734939][ T5483] -> #1 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 113.744442][ T5483] __flush_work+0x103/0xa10 [ 113.749505][ T5483] hci_dev_close_sync+0x22d/0x1160 [ 113.755202][ T5483] hci_dev_do_close+0x2e/0x90 [ 113.760425][ T5483] hci_unregister_dev+0x1eb/0x600 [ 113.765997][ T5483] vhci_release+0x7f/0x100 [ 113.772016][ T5483] __fput+0x270/0xbb0 [ 113.777076][ T5483] task_work_run+0x14d/0x240 [ 113.783273][ T5483] do_exit+0xa92/0x2ae0 [ 113.788081][ T5483] do_group_exit+0xd4/0x2a0 [ 113.793492][ T5483] get_signal+0x23ba/0x2790 [ 113.798568][ T5483] arch_do_signal_or_restart+0x90/0x7f0 [ 113.806002][ T5483] exit_to_user_mode_prepare+0x11f/0x240 [ 113.812449][ T5483] syscall_exit_to_user_mode+0x1d/0x60 [ 113.818726][ T5483] do_syscall_64+0x4b/0x110 [ 113.823873][ T5483] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 113.830326][ T5483] [ 113.830326][ T5483] -> #0 (&hdev->req_lock){+.+.}-{3:3}: [ 113.838350][ T5483] __lock_acquire+0x2e3d/0x5de0 [ 113.843832][ T5483] lock_acquire+0x1ae/0x510 [ 113.849128][ T5483] __mutex_lock+0x181/0x1340 [ 113.854247][ T5483] hci_dev_do_close+0x26/0x90 [ 113.859447][ T5483] hci_rfkill_set_block+0x1b9/0x200 [ 113.865382][ T5483] rfkill_set_block+0x200/0x550 [ 113.871021][ T5483] rfkill_fop_write+0x2d4/0x570 [ 113.876394][ T5483] vfs_write+0x2a4/0xdf0 [ 113.881343][ T5483] ksys_write+0x1f0/0x250 [ 113.887859][ T5483] do_syscall_64+0x3f/0x110 [ 113.893328][ T5483] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 113.899949][ T5483] [ 113.899949][ T5483] other info that might help us debug this: [ 113.899949][ T5483] [ 113.910356][ T5483] Chain exists of: [ 113.910356][ T5483] &hdev->req_lock --> &data->open_mutex --> rfkill_global_mutex [ 113.910356][ T5483] [ 113.924091][ T5483] Possible unsafe locking scenario: [ 113.924091][ T5483] [ 113.931535][ T5483] CPU0 CPU1 [ 113.937266][ T5483] ---- ---- [ 113.942625][ T5483] lock(rfkill_global_mutex); [ 113.947996][ T5483] lock(&data->open_mutex); [ 113.955264][ T5483] lock(rfkill_global_mutex); [ 113.963153][ T5483] lock(&hdev->req_lock); [ 113.968003][ T5483] [ 113.968003][ T5483] *** DEADLOCK *** [ 113.968003][ T5483] [ 113.976527][ T5483] 1 lock held by syz-executor.0/5483: [ 113.982536][ T5483] #0: ffffffff8ef22848 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x16e/0x570 [ 113.996944][ T5483] [ 113.996944][ T5483] stack backtrace: [ 114.003385][ T5483] CPU: 0 PID: 5483 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-14142-g90b0c2b2edd1 #0 [ 114.014310][ T5483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 114.026478][ T5483] Call Trace: [ 114.030060][ T5483] [ 114.033020][ T5483] dump_stack_lvl+0xd9/0x1b0 [ 114.037901][ T5483] check_noncircular+0x311/0x3f0 [ 114.043138][ T5483] ? print_circular_bug+0x750/0x750 [ 114.048398][ T5483] ? __read_once_word_nocheck+0x9/0x10 [ 114.053895][ T5483] ? mark_lock+0x105/0x1950 [ 114.058959][ T5483] __lock_acquire+0x2e3d/0x5de0 [ 114.064017][ T5483] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 114.070233][ T5483] ? __lock_acquire+0x182f/0x5de0 [ 114.075812][ T5483] lock_acquire+0x1ae/0x510 [ 114.080831][ T5483] ? hci_dev_do_close+0x26/0x90 [ 114.085747][ T5483] ? lock_sync+0x190/0x190 [ 114.090177][ T5483] ? preempt_count_sub+0x150/0x150 [ 114.095675][ T5483] __mutex_lock+0x181/0x1340 [ 114.100364][ T5483] ? hci_dev_do_close+0x26/0x90 [ 114.105217][ T5483] ? hci_dev_do_close+0x26/0x90 [ 114.110163][ T5483] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 114.116075][ T5483] ? lock_acquire+0x1ae/0x510 [ 114.120977][ T5483] ? find_held_lock+0x2d/0x110 [ 114.125937][ T5483] ? rfkill_set_block+0x195/0x550 [ 114.130999][ T5483] ? reacquire_held_locks+0x4b0/0x4b0 [ 114.137612][ T5483] ? hci_dev_do_close+0x26/0x90 [ 114.142754][ T5483] hci_dev_do_close+0x26/0x90 [ 114.147632][ T5483] hci_rfkill_set_block+0x1b9/0x200 [ 114.153299][ T5483] ? lockdep_hardirqs_on+0x7d/0x100 [ 114.158843][ T5483] ? hci_power_on+0x670/0x670 [ 114.163979][ T5483] rfkill_set_block+0x200/0x550 [ 114.169731][ T5483] rfkill_fop_write+0x2d4/0x570 [ 114.175392][ T5483] ? rfkill_register+0xb30/0xb30 [ 114.180687][ T5483] ? security_file_permission+0x94/0x100 [ 114.187006][ T5483] vfs_write+0x2a4/0xdf0 [ 114.191889][ T5483] ? rfkill_register+0xb30/0xb30 [ 114.196858][ T5483] ? kernel_write+0x6c0/0x6c0 [ 114.202063][ T5483] ? __might_fault+0xe6/0x1a0 [ 114.207196][ T5483] ? __fget_files+0x1c6/0x340 [ 114.211972][ T5483] ? __fget_light+0xe6/0x260 [ 114.217021][ T5483] ksys_write+0x1f0/0x250 [ 114.221461][ T5483] ? __ia32_sys_read+0xb0/0xb0 [ 114.226498][ T5483] ? syscall_enter_from_user_mode+0x26/0x80 [ 114.232573][ T5483] do_syscall_64+0x3f/0x110 [ 114.237099][ T5483] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 114.243377][ T5483] RIP: 0033:0x7f2f8867cb29 [ 114.248335][ T5483] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 114.269534][ T5483] RSP: 002b:00007f2f8949a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.278214][ T5483] RAX: ffffffffffffffda RBX: 00007f2f8879bf80 RCX: 00007f2f8867cb29 [ 114.286361][ T5483] RDX: 0000000000000008 RSI: 0000000020000040 RDI: 0000000000000003 [ 114.294590][ T5483] RBP: 00007f2f886c847a R08: 0000000000000000 R09: 0000000000000000 [ 114.303176][ T5483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.311609][ T5483] R13: 000000000000000b R14: 00007f2f8879bf80 R15: 00007ffc4d1b8ee8 [ 114.320627][ T5483]