[ 81.760507][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 81.760527][ T42] audit: type=1400 audit(1786353562.152:208): avc: denied { transition } for pid=5989 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 81.771790][ T42] audit: type=1400 audit(1786353562.162:209): avc: denied { noatsecure } for pid=5989 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 81.779747][ T42] audit: type=1400 audit(1786353562.162:210): avc: denied { rlimitinh } for pid=5989 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 81.787479][ T42] audit: type=1400 audit(1786353562.162:211): avc: denied { siginh } for pid=5989 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 82.003550][ T942] cfg80211: failed to load regulatory.db
[ 84.362138][ T42] audit: type=1400 audit(1786353564.762:212): avc: denied { write } for pid=5995 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 84.420100][ T42] audit: type=1400 audit(1786353564.812:213): avc: denied { write } for pid=5998 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 85.079568][ T42] audit: type=1400 audit(1786353565.472:214): avc: denied { write } for pid=6001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 85.162473][ T42] audit: type=1400 audit(1786353565.552:215): avc: denied { write } for pid=6004 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 85.382487][ T42] audit: type=1400 audit(1786353565.782:216): avc: denied { write } for pid=6008 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 85.438096][ T42] audit: type=1400 audit(1786353565.832:217): avc: denied { write } for pid=6011 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 86.848492][ T42] kauditd_printk_skb: 6 callbacks suppressed
[ 86.848513][ T42] audit: type=1400 audit(1786353567.242:224): avc: denied { write } for pid=6036 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 86.895158][ T42] audit: type=1400 audit(1786353567.292:225): avc: denied { write } for pid=6039 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 86.999201][ T42] audit: type=1400 audit(1786353567.392:226): avc: denied { write } for pid=6042 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 87.045626][ T42] audit: type=1400 audit(1786353567.442:227): avc: denied { write } for pid=6045 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:15034' (ED25519) to the list of known hosts.
[ 89.043355][ T42] audit: type=1400 audit(1786353569.442:228): avc: denied { mounton } for pid=6056 comm="syz-executor370" path="/sys/kernel/config" dev="configfs" ino=2093 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 89.069549][ T6056]
[ 89.077695][ T42] audit: type=1400 audit(1786353569.452:229): avc: denied { mount } for pid=6056 comm="syz-executor370" name="/" dev="configfs" ino=2093 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 89.077735][ T42] audit: type=1400 audit(1786353569.452:230): avc: denied { search } for pid=6056 comm="syz-executor370" name="/" dev="configfs" ino=2093 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 89.077764][ T42] audit: type=1400 audit(1786353569.452:231): avc: denied { search } for pid=6056 comm="syz-executor370" name="usb_gadget" dev="configfs" ino=1456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 89.077795][ T42] audit: type=1400 audit(1786353569.452:232): avc: denied { write search } for pid=6056 comm="syz-executor370" name="usb_gadget" dev="configfs" ino=1456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 89.077825][ T42] audit: type=1400 audit(1786353569.452:233): avc: denied { add_name } for pid=6056 comm="syz-executor370" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 89.128124][ T6056] ======================================================
[ 89.131117][ T6056] WARNING: possible circular locking dependency detected
[ 89.134051][ T6056] syzkaller #0 Not tainted
[ 89.135933][ T6056] ------------------------------------------------------
[ 89.138778][ T6056] syz-executor370/6056 is trying to acquire lock:
[ 89.141427][ T6056] ffff88802444f870 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950
[ 89.145166][ T6056]
[ 89.145166][ T6056] but task is already holding lock:
[ 89.148172][ T6056] ffff88803e07ba40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0
[ 89.152289][ T6056]
[ 89.152289][ T6056] which lock already depends on the new lock.
[ 89.152289][ T6056]
[ 89.156585][ T6056]
[ 89.156585][ T6056] the existing dependency chain (in reverse order) is:
[ 89.160236][ T6056]
[ 89.160236][ T6056] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}:
[ 89.163852][ T6056] lock_acquire+0x1b9/0x370
[ 89.165979][ T6056] down_write+0x8b/0x1f0
[ 89.167992][ T6056] configfs_depend_item_unlocked+0xf3/0x6a0
[ 89.170610][ T6056] usbg_make_tpg+0x261/0x620
[ 89.172743][ T6056] target_fabric_make_tpg+0xab/0x8c0
[ 89.175192][ T6056] configfs_mkdir+0x51e/0xb70
[ 89.177261][ T6056] vfs_mkdir+0x361/0x850
[ 89.179259][ T6056] filename_mkdirat+0x48b/0x5e0
[ 89.181504][ T6056] __x64_sys_mkdir+0x6b/0x90
[ 89.183678][ T6056] do_syscall_64+0x115/0x870
[ 89.185800][ T6056] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.188436][ T6056]
[ 89.188436][ T6056] -> #1 (&opts->dep_lock){+.+.}-{4:4}:
[ 89.191019][ T6056] lock_acquire+0x1b9/0x370
[ 89.192572][ T6056] __mutex_lock+0x1a4/0x1bd0
[ 89.194577][ T6056] tcm_register_callback+0x1f/0x70
[ 89.196846][ T6056] usbg_enable_tpg+0x95/0x160
[ 89.198965][ T6056] target_tpg_enable+0x1fc/0x5d0
[ 89.201293][ T6056] target_fabric_tpg_base_enable_store+0x162/0x190
[ 89.204216][ T6056] configfs_write_iter+0x302/0x4e0
[ 89.206441][ T6056] vfs_write+0x6ac/0x1050
[ 89.208476][ T6056] ksys_write+0x12a/0x250
[ 89.210457][ T6056] do_syscall_64+0x115/0x870
[ 89.212617][ T6056] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.215245][ T6056]
[ 89.215245][ T6056] -> #0 (&p->frag_sem){++++}-{4:4}:
[ 89.218227][ T6056] check_prev_add+0xeb/0xe60
[ 89.220264][ T6056] __lock_acquire+0x136c/0x1a40
[ 89.222206][ T6056] lock_acquire+0x1b9/0x370
[ 89.224230][ T6056] down_write_killable+0x93/0x250
[ 89.226369][ T6056] configfs_rmdir+0x3fa/0x950
[ 89.228413][ T6056] vfs_rmdir+0x328/0x8a0
[ 89.230266][ T6056] filename_rmdir+0x31a/0x5c0
[ 89.232265][ T6056] __x64_sys_rmdir+0x46/0x70
[ 89.234500][ T6056] do_syscall_64+0x115/0x870
[ 89.236720][ T6056] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.239089][ T6056]
[ 89.239089][ T6056] other info that might help us debug this:
[ 89.239089][ T6056]
[ 89.242836][ T6056] Chain exists of:
[ 89.242836][ T6056] &p->frag_sem --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24
[ 89.242836][ T6056]
[ 89.248926][ T6056] Possible unsafe locking scenario:
[ 89.248926][ T6056]
[ 89.252191][ T6056] CPU0 CPU1
[ 89.254434][ T6056] ---- ----
[ 89.256596][ T6056] lock(&sb->s_type->i_mutex_key#24);
[ 89.258925][ T6056] lock(&opts->dep_lock);
[ 89.261872][ T6056] lock(&sb->s_type->i_mutex_key#24);
[ 89.265248][ T6056] lock(&p->frag_sem);
[ 89.267048][ T6056]
[ 89.267048][ T6056] *** DEADLOCK ***
[ 89.267048][ T6056]
[ 89.270422][ T6056] 3 locks held by syz-executor370/6056:
[ 89.272784][ T6056] #0: ffff888023ec4450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0
[ 89.276686][ T6056] #1: ffff8880471ee9c0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0
[ 89.281229][ T6056] #2: ffff88803e07ba40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0
[ 89.285176][ T6056]
[ 89.285176][ T6056] stack backtrace:
[ 89.287321][ T6056] CPU: 0 UID: 0 PID: 6056 Comm: syz-executor370 Not tainted syzkaller #0 PREEMPT(full)
[ 89.287337][ T6056] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 89.287352][ T6056] Call Trace:
[ 89.287374][ T6056]
[ 89.287379][ T6056] dump_stack_lvl+0x100/0x190
[ 89.287399][ T6056] print_circular_bug.cold+0x178/0x1c7
[ 89.287420][ T6056] check_noncircular+0x146/0x160
[ 89.287437][ T6056] check_prev_add+0xeb/0xe60
[ 89.287451][ T6056] __lock_acquire+0x136c/0x1a40
[ 89.287489][ T6056] lock_acquire+0x1b9/0x370
[ 89.287504][ T6056] ? configfs_rmdir+0x3fa/0x950
[ 89.287520][ T6056] ? __pfx___might_resched+0x10/0x10
[ 89.287537][ T6056] down_write_killable+0x93/0x250
[ 89.287553][ T6056] ? configfs_rmdir+0x3fa/0x950
[ 89.287568][ T6056] ? __pfx_down_write_killable+0x10/0x10
[ 89.287579][ T6056] ? configfs_rmdir+0x3be/0x950
[ 89.287599][ T6056] configfs_rmdir+0x3fa/0x950
[ 89.287616][ T6056] ? __pfx_configfs_rmdir+0x10/0x10
[ 89.287631][ T6056] ? __pfx_down_write+0x10/0x10
[ 89.287642][ T6056] vfs_rmdir+0x328/0x8a0
[ 89.287659][ T6056] filename_rmdir+0x31a/0x5c0
[ 89.287672][ T6056] ? __pfx_filename_rmdir+0x10/0x10
[ 89.287687][ T6056] ? do_getname+0x191/0x390
[ 89.287702][ T6056] __x64_sys_rmdir+0x46/0x70
[ 89.287715][ T6056] do_syscall_64+0x115/0x870
[ 89.287732][ T6056] ? clear_bhb_loop+0x70/0xc0
[ 89.287744][ T6056] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.287756][ T6056] RIP: 0033:0x7fd2f47c11d7
[ 89.287766][ T6056] Code: 00 00 90 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 00 31 c9 e8 ca 07 02 00 48 83 c4 18 c3 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
[ 89.287777][ T6056] RSP: 002b:00007fff71617f78 EFLAGS: 00000206 ORIG_RAX: 0000000000000054
[ 89.287798][ T6056] RAX: ffffffffffffffda RBX: 00007fd2f481c500 RCX: 00007fd2f47c11d7
[ 89.287805][ T6056] RDX: 0000000000000000 RSI: 00007fd2f484a320 RDI: 00007fd2f481c500
[ 89.287811][ T6056] RBP: 00007fd2f481c500 R08: 0000000000000000 R09: 00000000ffffffff
[ 89.287817][ T6056] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fff716181b8
[ 89.287824][ T6056] R13: 0000000000000002 R14: 00007fd2f4845cc0 R15: 0000000000000002
[ 89.287833][ T6056]
[ 89.650442][ T5876] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 89.800590][ T5876] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02
[ 89.805341][ T5876] usb 7-1: Dual-Role OTG device on HNP port
[ 89.808049][ T5876] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 89.813422][ T55] Using the BOT protocol
[ 89.819594][ T55] Using the UAS protocol
[ 89.823496][ T5876] scsi host6: uas
[ 89.828391][ C1] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000c0: 0000 [#1] SMP KASAN NOPTI
[ 89.832501][ C1] KASAN: null-ptr-deref in range [0x0000000000000600-0x0000000000000607]
[ 89.835527][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
[ 89.838386][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 89.841924][ C1] RIP: 0010:usbg_submit_command.isra.0+0x7d/0xdd0
[ 89.844286][ C1] Code: 3c 02 00 0f 85 16 0c 00 00 49 8b 45 00 48 8d b8 00 06 00 00 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e1 0b 00 00 48 8b 44 24 10 48 8b 80 00 06 00 00
[ 89.850466][ C1] RSP: 0018:ffffc900006a0bb0 EFLAGS: 00010006
[ 89.852616][ C1] RAX: dffffc0000000000 RBX: ffff88803059ea10 RCX: ffffffff87ea97f3
[ 89.856027][ C1] RDX: 00000000000000c0 RSI: ffffffff87ea89a9 RDI: 0000000000000600
[ 89.859321][ C1] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
[ 89.862670][ C1] R10: 0000000000000000 R11: ffffc900006a0ff8 R12: ffff888027174000
[ 89.866015][ C1] R13: ffff888027174000 R14: ffff88803059ea00 R15: dffffc0000000000
[ 89.869184][ C1] FS: 0000000000000000(0000) GS:ffff8880d5cd7000(0000) knlGS:0000000000000000
[ 89.872814][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 89.875588][ C1] CR2: 000055d9b26b7418 CR3: 00000000343b6000 CR4: 0000000000352ef0
[ 89.878882][ C1] Call Trace:
[ 89.880318][ C1]
[ 89.881539][ C1] ? lock_acquire+0x301/0x370
[ 89.883538][ C1] ? dummy_timer+0x120f/0x36f0
[ 89.885554][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 89.888029][ C1] uasp_cmd_complete+0x97/0x110
[ 89.890047][ C1] dummy_timer+0x1221/0x36f0
[ 89.891995][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 89.894387][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 89.896447][ C1] ? rcu_is_watching+0x12/0xc0
[ 89.898445][ C1] ? rcu_is_watching+0x12/0xc0
[ 89.900423][ C1] ? trace_irq_enable.constprop.0+0x122/0x160
[ 89.902824][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 89.904979][ C1] __hrtimer_run_queues+0x462/0x9c0
[ 89.907130][ C1] hrtimer_run_softirq+0x17d/0x2c0
[ 89.909289][ C1] handle_softirqs+0x1ea/0x9b0
[ 89.911293][ C1] ? __pfx_handle_softirqs+0x10/0x10
[ 89.913537][ C1] ? _raw_spin_unlock+0x28/0x50
[ 89.915588][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720
[ 89.917919][ C1] __irq_exit_rcu+0x162/0x210
[ 89.919945][ C1] irq_exit_rcu+0x9/0x30
[ 89.921726][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0
[ 89.924101][ C1]
[ 89.925348][ C1]
[ 89.926589][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 89.929081][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[ 89.931409][ C1] Code: 55 aa 02 e9 83 4b 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 af 2e 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[ 89.939258][ C1] RSP: 0018:ffffc90000177e00 EFLAGS: 00000246
[ 89.941786][ C1] RAX: 000000000002975c RBX: ffff88801eef2540 RCX: ffffffff8bbcf335
[ 89.945079][ C1] RDX: 0000000000000001 RSI: ffffffff8c603000 RDI: ffffffff81df4bd7
[ 89.948278][ C1] RBP: ffffed1003dde4a8 R08: 0000000000000000 R09: ffffed100d4a678d
[ 89.951513][ C1] R10: ffff88806a533c6b R11: ffffffff81d6205c R12: 0000000000000000
[ 89.954755][ C1] R13: 0000000000000000 R14: 1ffff9200002efc4 R15: dffffc0000000000
[ 89.957780][ C1] ? finish_task_switch.isra.0+0x14c/0x10c0
[ 89.960251][ C1] ? ct_kernel_exit+0x125/0x180
[ 89.962286][ C1] ? do_idle+0x3a7/0x5b0
[ 89.964090][ C1] default_idle+0x9/0x10
[ 89.965876][ C1] default_idle_call+0x6c/0xb0
[ 89.967861][ C1] do_idle+0x3a7/0x5b0
[ 89.969607][ C1] ? __pfx_do_idle+0x10/0x10
[ 89.971561][ C1] ? finish_task_switch.isra.0+0x14c/0x10c0
[ 89.974069][ C1] cpu_startup_entry+0x4f/0x60
[ 89.976074][ C1] start_secondary+0x21d/0x2d0
[ 89.978064][ C1] ? __pfx_start_secondary+0x10/0x10
[ 89.980280][ C1] common_startup_64+0x13e/0x158
[ 89.982346][ C1]
[ 89.983696][ C1] Modules linked in:
[ 89.985327][ C1] ---[ end trace 0000000000000000 ]---
[ 89.987581][ C1] RIP: 0010:usbg_submit_command.isra.0+0x7d/0xdd0
[ 89.990226][ C1] Code: 3c 02 00 0f 85 16 0c 00 00 49 8b 45 00 48 8d b8 00 06 00 00 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e1 0b 00 00 48 8b 44 24 10 48 8b 80 00 06 00 00
[ 89.998090][ C1] RSP: 0018:ffffc900006a0bb0 EFLAGS: 00010006
[ 90.000630][ C1] RAX: dffffc0000000000 RBX: ffff88803059ea10 RCX: ffffffff87ea97f3
[ 90.003938][ C1] RDX: 00000000000000c0 RSI: ffffffff87ea89a9 RDI: 0000000000000600
[ 90.007166][ C1] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
[ 90.010266][ C1] R10: 0000000000000000 R11: ffffc900006a0ff8 R12: ffff888027174000
[ 90.013477][ C1] R13: ffff888027174000 R14: ffff88803059ea00 R15: dffffc0000000000
[ 90.016457][ C1] FS: 0000000000000000(0000) GS:ffff8880d5cd7000(0000) knlGS:0000000000000000
[ 90.020103][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 90.022729][ C1] CR2: 000055d9b26b7418 CR3: 00000000343b6000 CR4: 0000000000352ef0
[ 90.025953][ C1] Kernel panic - not syncing: Fatal exception in interrupt
[ 90.029627][ C1] Kernel Offset: disabled
[ 90.031449][ C1] Rebooting in 86400 seconds..