ci-upstream-kasan-gce-selinux-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-selinux-root/syz-executor1965172656 <...> Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-selinux-root/syz-executor1965172656", ["ci-upstream-kasan-gce-selinux-root/syz-executor1965172656"], 0x7fff40f74be0 /* 10 vars */) = 0 brk(NULL) = 0x55555f529000 brk(0x55555f529d80) = 0x55555f529d80 arch_prctl(ARCH_SET_FS, 0x55555f529400) = 0 set_tid_address(0x55555f5296d0) = 5621 set_robust_list(0x55555f5296e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-selinux-root/syz-executor1965172656", 4096) = 63 getrandom("\x11\xab\x69\xa2\xd0\x35\x4e\x32", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555f529d80 brk(0x55555f54ad80) = 0x55555f54ad80 brk(0x55555f54b000) = 0x55555f54b000 mprotect(0x7f378fcc5000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program mkdirat(AT_FDCWD, "./config", 0777) = 0 mount(NULL, "./config", "configfs", 0, NULL) = 0 [ 71.731239][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 71.731255][ T29] audit: type=1400 audit(1785882620.914:129): avc: denied { execmem } for pid=5621 comm="syz-executor196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [ 71.766961][ T29] audit: type=1400 audit(1785882620.954:130): avc: denied { mounton } for pid=5621 comm="syz-executor196" path="/root/config" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 71.790252][ T29] audit: type=1400 audit(1785882620.954:131): avc: denied { mount } for pid=5621 comm="syz-executor196" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/tcm.0", 0777) = 0 mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0777) = 0 mkdirat(AT_FDCWD, "./config/target/usb_gadget", 0777) = 0 mkdirat(AT_FDCWD, "./config/target/usb_gadget/naa.6001405123456789", 0777) = 0 mkdirat(AT_FDCWD, "./config/target/usb_gadget/naa.6001405123456789/tpgt_1", 0777) = 0 [ 71.813391][ T29] audit: type=1400 audit(1785882620.964:132): avc: denied { search } for pid=5621 comm="syz-executor196" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.836373][ T29] audit: type=1400 audit(1785882620.964:133): avc: denied { search } for pid=5621 comm="syz-executor196" name="usb_gadget" dev="configfs" ino=3548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.849165][ T5621] [ 71.860437][ T29] audit: type=1400 audit(1785882620.964:134): avc: denied { write search } for pid=5621 comm="syz-executor196" name="usb_gadget" dev="configfs" ino=3548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.861953][ T5621] ====================================================== [ 71.861964][ T5621] WARNING: possible circular locking dependency detected [ 71.861971][ T5621] syzkaller #0 Not tainted [ 71.861980][ T5621] ------------------------------------------------------ [ 71.861987][ T5621] syz-executor196/5621 is trying to acquire lock: [ 71.886236][ T29] audit: type=1400 audit(1785882620.964:135): avc: denied { add_name } for pid=5621 comm="syz-executor196" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.892727][ T5621] ffffffff90253240 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 71.900049][ T29] audit: type=1400 audit(1785882620.964:136): avc: denied { create } for pid=5621 comm="syz-executor196" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 71.904218][ T5621] [ 71.904218][ T5621] but task is already holding lock: [ 71.904225][ T5621] ffff88807b29c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 71.911536][ T29] audit: type=1400 audit(1785882621.004:137): avc: denied { search } for pid=5621 comm="syz-executor196" name="/" dev="configfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.917613][ T5621] [ 71.917613][ T5621] which lock already depends on the new lock. [ 71.917613][ T5621] [ 71.917620][ T5621] [ 71.917620][ T5621] the existing dependency chain (in reverse order) is: [ 71.917626][ T5621] [ 71.917626][ T5621] -> #3 (&gi->lock){+.+.}-{4:4}: [ 71.917661][ T5621] lock_acquire+0x1b9/0x370 [ 71.938751][ T29] audit: type=1400 audit(1785882621.004:138): avc: denied { search } for pid=5621 comm="syz-executor196" name="usb_gadget" dev="configfs" ino=3548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.947090][ T5621] __mutex_lock+0x1a4/0x1bd0 [ 71.947116][ T5621] config_usb_cfg_link+0x57/0x3a0 [ 72.070943][ T5621] configfs_symlink+0x540/0x11f0 [ 72.076405][ T5621] vfs_symlink+0x178/0x4d0 [ 72.081332][ T5621] filename_symlinkat+0x2a6/0x560 [ 72.086857][ T5621] __x64_sys_symlinkat+0x9c/0xe0 [ 72.092299][ T5621] do_syscall_64+0x115/0x870 [ 72.097392][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.103784][ T5621] [ 72.103784][ T5621] -> #2 (&sb->s_type->i_mutex_key#17){+.+.}-{4:4}: [ 72.112456][ T5621] lock_acquire+0x1b9/0x370 [ 72.117466][ T5621] down_write+0x8b/0x1f0 [ 72.122212][ T5621] configfs_depend_item_unlocked+0xf3/0x6a0 [ 72.128609][ T5621] usbg_make_tpg+0x261/0x620 [ 72.133701][ T5621] target_fabric_make_tpg+0xab/0x8c0 [ 72.139493][ T5621] configfs_mkdir+0x51e/0xb70 [ 72.144675][ T5621] vfs_mkdir+0x361/0x850 [ 72.149425][ T5621] filename_mkdirat+0x48b/0x5e0 [ 72.154776][ T5621] __x64_sys_mkdirat+0x89/0xc0 [ 72.160044][ T5621] do_syscall_64+0x115/0x870 [ 72.165137][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.171529][ T5621] [ 72.171529][ T5621] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 72.179150][ T5621] lock_acquire+0x1b9/0x370 [ 72.184156][ T5621] __mutex_lock+0x1a4/0x1bd0 [ 72.189257][ T5621] usbg_make_tpg+0x1a4/0x620 [ 72.194356][ T5621] target_fabric_make_tpg+0xab/0x8c0 [ 72.200160][ T5621] configfs_mkdir+0x51e/0xb70 [ 72.205353][ T5621] vfs_mkdir+0x361/0x850 [ 72.210110][ T5621] filename_mkdirat+0x48b/0x5e0 [ 72.215465][ T5621] __x64_sys_mkdirat+0x89/0xc0 [ 72.220731][ T5621] do_syscall_64+0x115/0x870 [ 72.225828][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.232222][ T5621] [ 72.232222][ T5621] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 72.240109][ T5621] check_prev_add+0xeb/0xe60 [ 72.245201][ T5621] __lock_acquire+0x136c/0x1a40 [ 72.250553][ T5621] lock_acquire+0x1b9/0x370 [ 72.255558][ T5621] __mutex_lock+0x1a4/0x1bd0 [ 72.260651][ T5621] tcm_alloc+0x20/0x440 [ 72.265312][ T5621] usb_get_function+0x5e/0xd0 [ 72.270495][ T5621] config_usb_cfg_link+0x1ed/0x3a0 [ 72.276113][ T5621] configfs_symlink+0x540/0x11f0 [ 72.281559][ T5621] vfs_symlink+0x178/0x4d0 [ 72.286481][ T5621] filename_symlinkat+0x2a6/0x560 [ 72.292011][ T5621] __x64_sys_symlinkat+0x9c/0xe0 [ 72.297456][ T5621] do_syscall_64+0x115/0x870 [ 72.302551][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.308943][ T5621] [ 72.308943][ T5621] other info that might help us debug this: [ 72.308943][ T5621] [ 72.319142][ T5621] Chain exists of: [ 72.319142][ T5621] tpg_instances_lock --> &sb->s_type->i_mutex_key#17 --> &gi->lock [ 72.319142][ T5621] [ 72.332945][ T5621] Possible unsafe locking scenario: [ 72.332945][ T5621] [ 72.340366][ T5621] CPU0 CPU1 [ 72.345704][ T5621] ---- ---- [ 72.351041][ T5621] lock(&gi->lock); [ 72.354912][ T5621] lock(&sb->s_type->i_mutex_key#17); [ 72.362872][ T5621] lock(&gi->lock); [ 72.369262][ T5621] lock(tpg_instances_lock); [ 72.373919][ T5621] [ 72.373919][ T5621] *** DEADLOCK *** [ 72.373919][ T5621] [ 72.382045][ T5621] 3 locks held by syz-executor196/5621: [ 72.387575][ T5621] #0: ffff88801e726450 (sb_writers#9){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 72.396983][ T5621] #1: ffff88807f980f80 (&sb->s_type->i_mutex_key#17){+.+.}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 72.407858][ T5621] #2: ffff88807b29c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 72.417246][ T5621] [ 72.417246][ T5621] stack backtrace: [ 72.423131][ T5621] CPU: 0 UID: 0 PID: 5621 Comm: syz-executor196 Not tainted syzkaller #0 PREEMPT(full) [ 72.423153][ T5621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 72.423169][ T5621] Call Trace: [ 72.423177][ T5621] [ 72.423184][ T5621] dump_stack_lvl+0x100/0x190 [ 72.423208][ T5621] print_circular_bug.cold+0x178/0x1c7 [ 72.423235][ T5621] check_noncircular+0x146/0x160 [ 72.423258][ T5621] check_prev_add+0xeb/0xe60 [ 72.423278][ T5621] __lock_acquire+0x136c/0x1a40 [ 72.423302][ T5621] lock_acquire+0x1b9/0x370 [ 72.423322][ T5621] ? tcm_alloc+0x20/0x440 [ 72.423343][ T5621] ? __pfx___might_resched+0x10/0x10 [ 72.423365][ T5621] __mutex_lock+0x1a4/0x1bd0 [ 72.423386][ T5621] ? tcm_alloc+0x20/0x440 [ 72.423405][ T5621] ? tcm_alloc+0x20/0x440 [ 72.423425][ T5621] ? __mutex_lock+0x26d/0x1bd0 [ 72.423445][ T5621] ? config_usb_cfg_link+0x57/0x3a0 [ 72.423466][ T5621] ? __pfx___mutex_lock+0x10/0x10 [ 72.423495][ T5621] ? __pfx_selinux_inode_permission+0x10/0x10 [ 72.423518][ T5621] ? tcm_alloc+0x20/0x440 [ 72.423537][ T5621] tcm_alloc+0x20/0x440 [ 72.423557][ T5621] usb_get_function+0x5e/0xd0 [ 72.423581][ T5621] config_usb_cfg_link+0x1ed/0x3a0 [ 72.423602][ T5621] ? mntput_no_expire+0xe7/0x220 [ 72.423620][ T5621] configfs_symlink+0x540/0x11f0 [ 72.423645][ T5621] ? __pfx_configfs_symlink+0x10/0x10 [ 72.423671][ T5621] vfs_symlink+0x178/0x4d0 [ 72.423694][ T5621] filename_symlinkat+0x2a6/0x560 [ 72.423716][ T5621] ? __pfx_filename_symlinkat+0x10/0x10 [ 72.423736][ T5621] ? strncpy_from_user+0x19d/0x2d0 [ 72.423759][ T5621] ? do_getname+0x191/0x390 [ 72.423780][ T5621] __x64_sys_symlinkat+0x9c/0xe0 [ 72.423800][ T5621] do_syscall_64+0x115/0x870 [ 72.423820][ T5621] ? clear_bhb_loop+0x40/0x90 [ 72.423839][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.423857][ T5621] RIP: 0033:0x7f378fc34d79 [ 72.423875][ T5621] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 72.423894][ T5621] RSP: 002b:00007ffd17934a28 EFLAGS: 00000246 ORIG_RAX: 000000000000010a symlinkat("./config/usb_gadget/g1/functions/tcm.0", AT_FDCWD, "./config/usb_gadget/g1/configs/c.1/tcm.0") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 72.423913][ T5621] RAX: ffffffff