[ 65.294213][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 65.294226][ T43] audit: type=1400 audit(1789218706.436:215): avc: denied { transition } for pid=5978 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.296425][ T43] audit: type=1400 audit(1789218706.436:216): avc: denied { noatsecure } for pid=5978 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.296459][ T43] audit: type=1400 audit(1789218706.436:217): avc: denied { rlimitinh } for pid=5978 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 65.296479][ T43] audit: type=1400 audit(1789218706.436:218): avc: denied { siginh } for pid=5978 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 68.125090][ T43] audit: type=1400 audit(1789218709.266:219): avc: denied { write } for pid=5982 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.178006][ T43] audit: type=1400 audit(1789218709.326:220): avc: denied { write } for pid=5985 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.266117][ T43] audit: type=1400 audit(1789218709.406:221): avc: denied { write } for pid=5988 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.321807][ T43] audit: type=1400 audit(1789218709.466:222): avc: denied { write } for pid=5991 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.629689][ T43] audit: type=1400 audit(1789218709.776:223): avc: denied { write } for pid=5994 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 68.694571][ T43] audit: type=1400 audit(1789218709.836:224): avc: denied { write } for pid=5997 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.440317][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 70.440336][ T43] audit: type=1400 audit(1789218711.586:229): avc: denied { write } for pid=6016 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.502616][ T43] audit: type=1400 audit(1789218711.646:230): avc: denied { write } for pid=6019 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.605320][ T43] audit: type=1400 audit(1789218711.746:231): avc: denied { write } for pid=6022 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.661331][ T43] audit: type=1400 audit(1789218711.806:232): avc: denied { write } for pid=6026 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.744969][ T43] audit: type=1400 audit(1789218711.886:233): avc: denied { write } for pid=6031 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.825972][ T43] audit: type=1400 audit(1789218711.966:234): avc: denied { write } for pid=6035 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:48223' (ED25519) to the list of known hosts. [ 71.440630][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.440705][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.091380][ T43] audit: type=1400 audit(1789218713.236:235): avc: denied { unlink } for pid=6041 comm="syz-executor469" name="#1" dev="tmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 72.098869][ T43] audit: type=1400 audit(1789218713.246:236): avc: denied { mount } for pid=6041 comm="syz-executor469" name="/" dev="overlay" ino=7 sconte ** replaying previous printk message ** [ 72.098869][ T43] audit: type=1400 audit(1789218713.246:236): avc: denied { mount } for pid=6041 comm="syz-executor469" name="/" dev="overlay" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 72.104307][ T6041] block2mtd: error: cannot open device /tmp/ovl_bug_7ivaQs/merged/nonexistent [ 72.105510][ T6041] [ 72.121927][ T6041] ====================================================== [ 72.124957][ T6041] WARNING: possible circular locking dependency detected [ 72.128006][ T6041] syzkaller #0 Not tainted [ 72.130112][ T6041] ------------------------------------------------------ [ 72.133090][ T6041] syz-executor469/6041 is trying to acquire lock: [ 72.135839][ T6041] ffff888024d8c460 (sb_writers#6){.+.+}-{0:0}, at: ovl_create_object+0x130/0x3b0 [ 72.140033][ T6041] [ 72.140033][ T6041] but task is already holding lock: [ 72.143521][ T6041] ffff88805802a7a8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: lookup_open+0xb13/0x1990 [ 72.149577][ T6041] [ 72.149577][ T6041] which lock already depends on the new lock. [ 72.149577][ T6041] [ 72.155227][ T6041] [ 72.155227][ T6041] the existing dependency chain (in reverse order) is: [ 72.158996][ T6041] [ 72.158996][ T6041] -> #4 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}: [ 72.162769][ T6041] lock_acquire+0x1d1/0x380 [ 72.164911][ T6041] down_read+0x99/0x4c0 [ 72.166940][ T6041] lookup_slow+0x42/0x70 [ 72.169338][ T6041] path_lookupat+0x5e8/0xc40 [ 72.171948][ T6041] filename_lookup+0x202/0x590 [ 72.174569][ T6041] kern_path+0x37/0x50 [ 72.176676][ T6041] lookup_bdev+0xd8/0x2a0 [ 72.178862][ T6041] bdev_file_open_by_path+0x82/0x330 [ 72.181504][ T6041] block2mtd_setup2.isra.0+0x2ee/0xbd0 [ 72.184089][ T6041] block2mtd_setup+0xbd/0xd0 [ 72.186268][ T6041] param_attr_store+0x199/0x300 [ 72.188483][ T6041] module_attr_store+0x58/0x80 [ 72.190701][ T6041] sysfs_kf_write+0xf2/0x150 [ 72.192952][ T6041] kernfs_fop_write_iter+0x3e0/0x5f0 [ 72.195548][ T6041] iter_file_splice_write+0x830/0x10b0 [ 72.198154][ T6041] do_splice+0x109c/0x1fa0 [ 72.200478][ T6041] __do_splice+0x33b/0x370 [ 72.202618][ T6041] __x64_sys_splice+0x187/0x250 [ 72.204727][ T6041] do_syscall_64+0x123/0x790 [ 72.206767][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.209360][ T6041] [ 72.209360][ T6041] -> #3 (param_lock){+.+.}-{4:4}: [ 72.212297][ T6041] lock_acquire+0x1d1/0x380 [ 72.214448][ T6041] __mutex_lock+0x1a4/0x1bd0 [ 72.216623][ T6041] param_attr_store+0xec/0x300 [ 72.218958][ T6041] module_attr_store+0x58/0x80 [ 72.221323][ T6041] sysfs_kf_write+0xf2/0x150 [ 72.223583][ T6041] kernfs_fop_write_iter+0x3e0/0x5f0 [ 72.226195][ T6041] vfs_write+0x6af/0x1050 [ 72.228404][ T6041] ksys_write+0x12a/0x250 [ 72.230666][ T6041] do_syscall_64+0x123/0x790 [ 72.232944][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.235722][ T6041] [ 72.235722][ T6041] -> #2 (&of->mutex){+.+.}-{4:4}: [ 72.238938][ T6041] lock_acquire+0x1d1/0x380 [ 72.241221][ T6041] __mutex_lock+0x1a4/0x1bd0 [ 72.243357][ T6041] kernfs_fop_write_iter+0x2c2/0x5f0 [ 72.245784][ T6041] iter_file_splice_write+0x830/0x10b0 [ 72.248244][ T6041] do_splice+0x109c/0x1fa0 [ 72.250479][ T6041] __do_splice+0x33b/0x370 [ 72.252807][ T6041] __x64_sys_splice+0x187/0x250 [ 72.255146][ T6041] do_syscall_64+0x123/0x790 [ 72.257358][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.260465][ T6041] [ 72.260465][ T6041] -> #1 (&pipe->mutex){+.+.}-{4:4}: [ 72.263729][ T6041] lock_acquire+0x1d1/0x380 [ 72.265878][ T6041] __mutex_lock+0x1a4/0x1bd0 [ 72.268012][ T6041] pipe_lock+0x69/0x80 [ 72.270061][ T6041] iter_file_splice_write+0x1fd/0x10b0 [ 72.272613][ T6041] do_splice+0x109c/0x1fa0 [ 72.274800][ T6041] __do_splice+0x33b/0x370 [ 72.276791][ T6041] __x64_sys_splice+0x187/0x250 [ 72.279010][ T6041] do_syscall_64+0x123/0x790 [ 72.281373][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.284198][ T6041] [ 72.284198][ T6041] -> #0 (sb_writers#6){.+.+}-{0:0}: [ 72.287485][ T6041] check_prev_add+0xeb/0xe60 [ 72.289651][ T6041] __lock_acquire+0x1528/0x1f40 [ 72.292028][ T6041] lock_acquire+0x1d1/0x380 [ 72.294512][ T6041] mnt_want_write+0x6f/0x420 [ 72.296627][ T6041] ovl_create_object+0x130/0x3b0 [ 72.298984][ T6041] lookup_open+0x1255/0x1990 [ 72.301261][ T6041] path_openat+0xa2c/0x2440 [ 72.303424][ T6041] do_file_open+0x20e/0x430 [ 72.305686][ T6041] do_sys_openat2+0x10f/0x1e0 [ 72.308043][ T6041] __x64_sys_openat+0x12d/0x210 [ 72.310462][ T6041] do_syscall_64+0x123/0x790 [ 72.312743][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.315508][ T6041] [ 72.315508][ T6041] other info that might help us debug this: [ 72.315508][ T6041] [ 72.319883][ T6041] Chain exists of: [ 72.319883][ T6041] sb_writers#6 --> param_lock --> &ovl_i_mutex_dir_key[depth] [ 72.319883][ T6041] [ 72.325484][ T6041] Possible unsafe locking scenario: [ 72.325484][ T6041] [ 72.329258][ T6041] CPU0 CPU1 [ 72.332508][ T6041] ---- ---- [ 72.334823][ T6041] lock(&ovl_i_mutex_dir_key[depth]); [ 72.337128][ T6041] lock(param_lock); [ 72.340193][ T6041] lock(&ovl_i_mutex_dir_key[depth]); [ 72.343663][ T6041] rlock(sb_writers#6); [ 72.345440][ T6041] [ 72.345440][ T6041] *** DEADLOCK *** [ 72.345440][ T6041] [ 72.348840][ T6041] locks held by syz-executor469/6041: 2, last CPU#2: [ 72.351679][ T6041] #0: ffff88802a68c460 (sb_writers#13){.+.+}-{0:0}, at: lookup_open+0x150/0x1990 [ 72.355654][ T6041] #1: ffff88805802a7a8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: lookup_open+0xb13/0x1990 [ 72.360102][ T6041] [ 72.360102][ T6041] stack backtrace: [ 72.363039][ T6041] CPU: 2 UID: 0 PID: 6041 Comm: syz-executor469 Not tainted syzkaller #0 PREEMPT(full) [ 72.366983][ T6041] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.371993][ T6041] Call Trace: [ 72.373531][ T6041] [ 72.374784][ T6041] dump_stack_lvl+0x100/0x190 [ 72.376689][ T6041] print_circular_bug.cold+0x178/0x1be [ 72.379278][ T6041] check_noncircular+0x146/0x160 [ 72.381666][ T6041] check_prev_add+0xeb/0xe60 [ 72.383805][ T6041] ? do_raw_spin_unlock+0x145/0x1e0 [ 72.386072][ T6041] __lock_acquire+0x1528/0x1f40 [ 72.388220][ T6041] ? ovl_lookup+0x58f/0x6b0 [ 72.390294][ T6041] lock_acquire+0x1d1/0x380 [ 72.392407][ T6041] ? ovl_create_object+0x130/0x3b0 [ 72.394819][ T6041] ? __pfx___might_resched+0x10/0x10 [ 72.397198][ T6041] ? ovl_already_copied_up+0x10d/0x1c0 [ 72.399607][ T6041] mnt_want_write+0x6f/0x420 [ 72.401695][ T6041] ? ovl_create_object+0x130/0x3b0 [ 72.403961][ T6041] ovl_create_object+0x130/0x3b0 [ 72.406135][ T6041] ? __pfx_ovl_create_object+0x10/0x10 [ 72.408384][ T6041] ? bpf_lsm_inode_create+0x9/0x10 [ 72.410723][ T6041] ? security_inode_create+0xc4/0x280 [ 72.413619][ T6041] ? may_o_create+0x46/0x3a0 [ 72.415927][ T6041] ? __pfx_ovl_create+0x10/0x10 [ 72.418389][ T6041] lookup_open+0x1255/0x1990 [ 72.420507][ T6041] path_openat+0xa2c/0x2440 [ 72.422542][ T6041] ? __pfx_path_openat+0x10/0x10 [ 72.424712][ T6041] do_file_open+0x20e/0x430 [ 72.426600][ T6041] ? __pfx_do_file_open+0x10/0x10 [ 72.428818][ T6041] ? _raw_spin_unlock+0x28/0x50 [ 72.430918][ T6041] ? alloc_fd+0x471/0x7a0 [ 72.433123][ T6041] do_sys_openat2+0x10f/0x1e0 [ 72.435540][ T6041] ? __pfx_do_sys_openat2+0x10/0x10 [ 72.438263][ T6041] ? __fput+0x692/0xb50 [ 72.440241][ T6041] __x64_sys_openat+0x12d/0x210 [ 72.442360][ T6041] ? __pfx___x64_sys_openat+0x10/0x10 [ 72.444624][ T6041] do_syscall_64+0x123/0x790 [ 72.446605][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.449161][ T6041] RIP: 0033:0x7fadca23e437 [ 72.451073][ T6041] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 72.458963][ T6041] RSP: 002b:00007fff380044d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 72.462422][ T6041] RAX: ffffffffffffffda RBX: 000055555dddf400 RCX: 00007fadca23e437 [ 72.465824][ T6041] RDX: 0000000000000042 RSI: 00007fadca277192 RDI: ffffffffffffff9c [ 72.469234][ T6041] RBP: 00007fadca2770fe R08: 0000000000000000 R09: 0000000000000000 [ 72.472697][ T6041] R10: 00000000000001a4 R11: 0000000000000202 R12: 000055555dde1770 [ 72.476110][ T6041] R13: 0000000000000026 R14: 00007fff380045a0 R15: 0000000000000002 [ 72.479505][ T6041] [+] Setup working directory. [+] Mounted overlayfs. [+] Established sb_writers -> pipe->mutex. [+] Established pipe->mutex -> param_lock -> ovl_i_mutex_dir_key. [+] Triggered ovl_i_mutex_dir_key -> sb_writers. [+] Done. [ 76.557768][ T35] cfg80211: failed to load regulatory.db