[ 71.898779][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 71.898794][ T42] audit: type=1400 audit(1786631895.397:209): avc: denied { transition } for pid=5966 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.909142][ T42] audit: type=1400 audit(1786631895.397:210): avc: denied { noatsecure } for pid=5966 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.916494][ T42] audit: type=1400 audit(1786631895.397:211): avc: denied { rlimitinh } for pid=5966 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 71.922781][ T42] audit: type=1400 audit(1786631895.397:212): avc: denied { siginh } for pid=5966 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 75.152500][ T42] audit: type=1400 audit(1786631898.657:213): avc: denied { write } for pid=5971 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.207775][ T42] audit: type=1400 audit(1786631898.707:214): avc: denied { write } for pid=5974 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.150751][ T42] audit: type=1400 audit(1786631899.647:215): avc: denied { write } for pid=5977 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.213924][ T42] audit: type=1400 audit(1786631899.717:216): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.568669][ T42] audit: type=1400 audit(1786631900.067:217): avc: denied { write } for pid=5987 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.638936][ T42] audit: type=1400 audit(1786631900.137:218): avc: denied { write } for pid=5990 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.963072][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 76.963095][ T42] audit: type=1400 audit(1786631900.467:220): avc: denied { write } for pid=5996 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.584944][ T42] audit: type=1400 audit(1786631901.087:221): avc: denied { write } for pid=5999 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.627877][ T42] audit: type=1400 audit(1786631901.127:222): avc: denied { write } for pid=6002 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.748507][ T42] audit: type=1400 audit(1786631901.247:223): avc: denied { write } for pid=6006 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.811394][ T42] audit: type=1400 audit(1786631901.307:224): avc: denied { write } for pid=6010 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.899891][ T42] audit: type=1400 audit(1786631901.397:225): avc: denied { write } for pid=6015 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 77.972679][ T42] audit: type=1400 audit(1786631901.477:226): avc: denied { write } for pid=6018 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:60312' (ED25519) to the list of known hosts. [ 78.206691][ T42] audit: type=1400 audit(1786631901.707:227): avc: denied { mounton } for pid=6024 comm="syz-executor196" path="/sys/kernel/config" dev="configfs" ino=1088 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.216447][ T42] audit: type=1400 audit(1786631901.707:228): avc: denied { mount } for pid=6024 comm="syz-executor196" name="/" dev="configfs" ino=1088 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 78.220776][ T6024] [ 78.226007][ T42] audit: type=1400 audit(1786631901.707:229): avc: denied { search } for pid=6024 comm="syz-executor196" name="/" dev="configfs" ino=1088 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.226392][ T6024] ====================================================== [ 78.238351][ T6024] WARNING: possible circular locking dependency detected [ 78.241202][ T6024] syzkaller #0 Not tainted [ 78.243030][ T6024] ------------------------------------------------------ [ 78.245933][ T6024] syz-executor196/6024 is trying to acquire lock: [ 78.248539][ T6024] ffffffff901c9ee8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 78.252493][ T6024] [ 78.252493][ T6024] but task is already holding lock: [ 78.255533][ T6024] ffff888047017800 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 78.259572][ T6024] [ 78.259572][ T6024] which lock already depends on the new lock. [ 78.259572][ T6024] [ 78.263439][ T6024] [ 78.263439][ T6024] the existing dependency chain (in reverse order) is: [ 78.266173][ T6024] [ 78.266173][ T6024] -> #2 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 78.268843][ T6024] lock_acquire+0x1b9/0x370 [ 78.270591][ T6024] down_write+0x8b/0x1f0 [ 78.272180][ T6024] configfs_depend_item_unlocked+0xf3/0x6a0 [ 78.274185][ T6024] usbg_make_tpg+0x261/0x620 [ 78.275840][ T6024] target_fabric_make_tpg+0xab/0x8c0 [ 78.277650][ T6024] configfs_mkdir+0x51e/0xb70 [ 78.279278][ T6024] vfs_mkdir+0x361/0x850 [ 78.281073][ T6024] filename_mkdirat+0x48b/0x5e0 [ 78.283182][ T6024] __x64_sys_mkdir+0x6b/0x90 [ 78.285273][ T6024] do_syscall_64+0x115/0x870 [ 78.287385][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.290094][ T6024] [ 78.290094][ T6024] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 78.293394][ T6024] lock_acquire+0x1b9/0x370 [ 78.295561][ T6024] __mutex_lock+0x1a4/0x1bd0 [ 78.297653][ T6024] tcm_set_name+0x29/0xb0 [ 78.299646][ T6024] function_make+0x21c/0x3f0 [ 78.301705][ T6024] configfs_mkdir+0x51e/0xb70 [ 78.303854][ T6024] vfs_mkdir+0x361/0x850 [ 78.305702][ T6024] filename_mkdirat+0x48b/0x5e0 [ 78.307902][ T6024] __x64_sys_mkdir+0x6b/0x90 [ 78.309986][ T6024] do_syscall_64+0x115/0x870 [ 78.312089][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.314727][ T6024] [ 78.314727][ T6024] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 78.318021][ T6024] check_prev_add+0xeb/0xe60 [ 78.320100][ T6024] __lock_acquire+0x136c/0x1a40 [ 78.322254][ T6024] lock_acquire+0x1b9/0x370 [ 78.324320][ T6024] __mutex_lock+0x1a4/0x1bd0 [ 78.326393][ T6024] configfs_rmdir+0x5ae/0x950 [ 78.328528][ T6024] vfs_rmdir+0x328/0x8a0 [ 78.330479][ T6024] filename_rmdir+0x31a/0x5c0 [ 78.332585][ T6024] __x64_sys_rmdir+0x46/0x70 [ 78.334652][ T6024] do_syscall_64+0x115/0x870 [ 78.336740][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.339193][ T6024] [ 78.339193][ T6024] other info that might help us debug this: [ 78.339193][ T6024] [ 78.343077][ T6024] Chain exists of: [ 78.343077][ T6024] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 78.343077][ T6024] [ 78.348846][ T6024] Possible unsafe locking scenario: [ 78.348846][ T6024] [ 78.351806][ T6024] CPU0 CPU1 [ 78.353979][ T6024] ---- ---- [ 78.356200][ T6024] lock(&sb->s_type->i_mutex_key#24); [ 78.358450][ T6024] lock(&opts->dep_lock); [ 78.361274][ T6024] lock(&sb->s_type->i_mutex_key#24); [ 78.364461][ T6024] lock(gadget_subsys.su_mutex); [ 78.366546][ T6024] [ 78.366546][ T6024] *** DEADLOCK *** [ 78.366546][ T6024] [ 78.369653][ T6024] 3 locks held by syz-executor196/6024: [ 78.371927][ T6024] #0: ffff888024116450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 78.375555][ T6024] #1: ffff88804713e040 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 78.379893][ T6024] #2: ffff888047017800 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 78.383926][ T6024] [ 78.383926][ T6024] stack backtrace: [ 78.386341][ T6024] CPU: 2 UID: 0 PID: 6024 Comm: syz-executor196 Not tainted syzkaller #0 PREEMPT(full) [ 78.386364][ T6024] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.386384][ T6024] Call Trace: [ 78.386411][ T6024] [ 78.386418][ T6024] dump_stack_lvl+0x100/0x190 [ 78.386447][ T6024] print_circular_bug.cold+0x178/0x1c7 [ 78.386473][ T6024] check_noncircular+0x146/0x160 [ 78.386496][ T6024] check_prev_add+0xeb/0xe60 [ 78.386513][ T6024] ? __bfs+0x150/0x2a0 [ 78.386528][ T6024] __lock_acquire+0x136c/0x1a40 [ 78.386550][ T6024] lock_acquire+0x1b9/0x370 [ 78.386568][ T6024] ? configfs_rmdir+0x5ae/0x950 [ 78.386590][ T6024] ? __pfx___might_resched+0x10/0x10 [ 78.386610][ T6024] ? __lock_acquire+0x49f/0x1a40 [ 78.386628][ T6024] __mutex_lock+0x1a4/0x1bd0 [ 78.386650][ T6024] ? configfs_rmdir+0x5ae/0x950 [ 78.386670][ T6024] ? configfs_rmdir+0x5ae/0x950 [ 78.386691][ T6024] ? reacquire_held_locks+0xce/0x1e0 [ 78.386710][ T6024] ? __pfx___mutex_lock+0x10/0x10 [ 78.386729][ T6024] ? do_raw_spin_lock+0x128/0x260 [ 78.386751][ T6024] ? find_held_lock+0x2b/0x80 [ 78.386764][ T6024] ? fast_dput+0x2fe/0x6d0 [ 78.386787][ T6024] ? _raw_spin_unlock+0x28/0x50 [ 78.386803][ T6024] ? fast_dput+0x168/0x6d0 [ 78.386832][ T6024] ? configfs_rmdir+0x5ae/0x950 [ 78.386852][ T6024] configfs_rmdir+0x5ae/0x950 [ 78.386875][ T6024] ? __pfx_configfs_rmdir+0x10/0x10 [ 78.386895][ T6024] ? __pfx_down_write+0x10/0x10 [ 78.386918][ T6024] vfs_rmdir+0x328/0x8a0 [ 78.386940][ T6024] filename_rmdir+0x31a/0x5c0 [ 78.386958][ T6024] ? __pfx_filename_rmdir+0x10/0x10 [ 78.386979][ T6024] ? do_getname+0x191/0x390 [ 78.386999][ T6024] __x64_sys_rmdir+0x46/0x70 [ 78.387016][ T6024] do_syscall_64+0x115/0x870 [ 78.387036][ T6024] ? clear_bhb_loop+0x70/0xc0 [ 78.387054][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.387071][ T6024] RIP: 0033:0x7f1136a22e67 [ 78.387087][ T6024] Code: 00 00 90 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 00 31 c9 e8 ba 05 02 00 48 83 c4 18 c3 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 78.387102][ T6024] RSP: 002b:00007ffcb20341e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 78.387133][ T6024] RAX: ffffffffffffffda RBX: 00007f1136a7e488 RCX: 00007f1136a22e67 [ 78.387143][ T6024] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f1136a7e488 [ 78.387153][ T6024] RBP: 0000000000000001 R08: 00007f1136aab7c0 R09: 0000000000000001 [ 78.387162][ T6024] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcb2034318 [ 78.387172][ T6024] R13: 0000000000000002 R14: 00007f1136aa6cc0 R15: 0000000000000002 [ 78.387185][ T6024] [+] configfs mounted or already mounted. [+] usb_gadget created. [+] tcm function created. [+] target fabric directory created. [+] target fabric WWN created. [+] tpgt created. [+] strings dir created and removed. [+] uvc function created. [+] iTerminal opened. [+] iTerminal read. [+] Reproducer finished. [ 81.722946][ T61] cfg80211: failed to load regulatory.db