last executing test programs:
218.899092ms ago: executing program 0 (id=48):
select(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
184.13817ms ago: executing program 1 (id=49):
socket$pppoe(0x18, 0x1, 0x0)
183.442158ms ago: executing program 4 (id=51):
socket$caif_seqpacket(0x25, 0x5, 0x0)
183.034979ms ago: executing program 3 (id=52):
socket$isdn(0x22, 0x3, 0x0)
182.850495ms ago: executing program 2 (id=53):
socket$inet6_udp(0xa, 0x2, 0x0)
182.380187ms ago: executing program 0 (id=54):
socket$can_raw(0x1d, 0x3, 0x1)
181.75071ms ago: executing program 1 (id=55):
socket$key(0xf, 0x3, 0x2)
181.650796ms ago: executing program 4 (id=56):
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
132.686802ms ago: executing program 0 (id=57):
syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
131.876245ms ago: executing program 4 (id=58):
pipe(&(0x7f0000000000))
131.637339ms ago: executing program 3 (id=59):
shutdown(0xffffffffffffffff, 0x0)
131.481119ms ago: executing program 2 (id=60):
vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
130.933444ms ago: executing program 0 (id=61):
pselect6(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
130.186525ms ago: executing program 4 (id=62):
socket$inet6_dccp(0xa, 0x6, 0x0)
129.245506ms ago: executing program 1 (id=63):
syz_init_net_socket$netrom(0x6, 0x5, 0x0)
127.160517ms ago: executing program 3 (id=64):
socket$vsock_stream(0x28, 0x1, 0x0)
114.362804ms ago: executing program 0 (id=65):
socket$inet6_udplite(0xa, 0x2, 0x88)
113.84369ms ago: executing program 2 (id=66):
socket$pptp(0x18, 0x1, 0x2)
113.59629ms ago: executing program 4 (id=67):
syz_init_net_socket$llc(0x1a, 0x1, 0x0)
64.667317ms ago: executing program 1 (id=68):
epoll_wait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
64.532545ms ago: executing program 3 (id=69):
syz_init_net_socket$ax25(0x3, 0x2, 0x0)
64.463458ms ago: executing program 4 (id=70):
syz_init_net_socket$bt_cmtp(0x1f, 0x3, 0x5)
64.404982ms ago: executing program 3 (id=71):
socket$inet6(0xa, 0x1, 0x0)
64.356019ms ago: executing program 1 (id=72):
socket(0x1, 0x1, 0x0)
64.289642ms ago: executing program 2 (id=73):
socket$unix(0x1, 0x1, 0x0)
56.502737ms ago: executing program 2 (id=74):
socket$igmp(0x2, 0x3, 0x2)
44.77911ms ago: executing program 1 (id=75):
socket$hf(0x13, 0x2, 0x0)
429.56µs ago: executing program 3 (id=76):
socket$can_j1939(0x1d, 0x2, 0x7)
208.363µs ago: executing program 0 (id=77):
socket$qrtr(0x2a, 0x2, 0x0)
0s ago: executing program 2 (id=78):
getgid()
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts.
syzkaller login: [ 58.519577][ T5816] cgroup: Unknown subsys name 'net'
[ 58.667839][ T5816] cgroup: Unknown subsys name 'cpuset'
[ 58.676656][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 59.959325][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 62.178454][ T5900] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 62.659602][ T5920] ==================================================================
[ 62.667710][ T5920] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 62.675466][ T5920] Write of size 8 at addr ffff888142ba6408 by task syz-executor/5920
[ 62.683634][ T5920]
[ 62.686000][ T5920] CPU: 1 UID: 0 PID: 5920 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01215-g89d75c4c67ac #0
[ 62.686021][ T5920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 62.686035][ T5920] Call Trace:
[ 62.686041][ T5920]
[ 62.686047][ T5920] dump_stack_lvl+0x241/0x360
[ 62.686070][ T5920] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.686087][ T5920] ? __pfx__printk+0x10/0x10
[ 62.686103][ T5920] ? _printk+0xd5/0x120
[ 62.686117][ T5920] ? __virt_addr_valid+0x183/0x530
[ 62.686132][ T5920] ? __virt_addr_valid+0x183/0x530
[ 62.686148][ T5920] print_report+0x16e/0x5b0
[ 62.686167][ T5920] ? __virt_addr_valid+0x183/0x530
[ 62.686181][ T5920] ? __virt_addr_valid+0x183/0x530
[ 62.686194][ T5920] ? __virt_addr_valid+0x45f/0x530
[ 62.686208][ T5920] ? __phys_addr+0xba/0x170
[ 62.686223][ T5920] ? binder_add_device+0x5f/0xa0
[ 62.686242][ T5920] kasan_report+0x143/0x180
[ 62.686260][ T5920] ? binder_add_device+0x5f/0xa0
[ 62.686281][ T5920] binder_add_device+0x5f/0xa0
[ 62.686299][ T5920] binderfs_binder_device_create+0x878/0xab0
[ 62.686321][ T5920] binderfs_fill_super+0x96e/0xe70
[ 62.686341][ T5920] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.686376][ T5920] ? shrinker_register+0x160/0x230
[ 62.686399][ T5920] ? sget_fc+0x960/0xa50
[ 62.686413][ T5920] ? __pfx_set_anon_super_fc+0x10/0x10
[ 62.686429][ T5920] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.686448][ T5920] get_tree_nodev+0xb7/0x140
[ 62.686465][ T5920] vfs_get_tree+0x90/0x2b0
[ 62.686482][ T5920] do_new_mount+0x2be/0xb40
[ 62.686504][ T5920] ? __pfx_do_new_mount+0x10/0x10
[ 62.686527][ T5920] __se_sys_mount+0x2d6/0x3c0
[ 62.686546][ T5920] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 62.686567][ T5920] ? __pfx___se_sys_mount+0x10/0x10
[ 62.686586][ T5920] ? do_syscall_64+0x100/0x230
[ 62.686606][ T5920] ? __x64_sys_mount+0x20/0xc0
[ 62.686626][ T5920] do_syscall_64+0xf3/0x230
[ 62.686644][ T5920] ? clear_bhb_loop+0x35/0x90
[ 62.686665][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.686689][ T5920] RIP: 0033:0x7fad2db8e90a
[ 62.686707][ T5920] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 62.686720][ T5920] RSP: 002b:00007ffd9ea9b3e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 62.686737][ T5920] RAX: ffffffffffffffda RBX: 00007fad2dc0e663 RCX: 00007fad2db8e90a
[ 62.686749][ T5920] RDX: 00007fad2dc1dda7 RSI: 00007fad2dc0e663 RDI: 00007fad2dc1dda7
[ 62.686759][ T5920] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 62.686768][ T5920] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fad2dc28480
[ 62.686778][ T5920] R13: 00007ffd9ea9b468 R14: 0000000000000009 R15: 0000000000000000
[ 62.686794][ T5920]
[ 62.686804][ T5920]
[ 62.959727][ T5920] Allocated by task 5830:
[ 62.964041][ T5920] kasan_save_track+0x3f/0x80
[ 62.968712][ T5920] __kasan_kmalloc+0x98/0xb0
[ 62.973286][ T5920] __kmalloc_cache_noprof+0x243/0x390
[ 62.978644][ T5920] binderfs_binder_device_create+0x171/0xab0
[ 62.984713][ T5920] binderfs_fill_super+0x96e/0xe70
[ 62.989810][ T5920] get_tree_nodev+0xb7/0x140
[ 62.994413][ T5920] vfs_get_tree+0x90/0x2b0
[ 62.998856][ T5920] do_new_mount+0x2be/0xb40
[ 63.003382][ T5920] __se_sys_mount+0x2d6/0x3c0
[ 63.008052][ T5920] do_syscall_64+0xf3/0x230
[ 63.012546][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.018445][ T5920]
[ 63.020753][ T5920] Freed by task 5830:
[ 63.024715][ T5920] kasan_save_track+0x3f/0x80
[ 63.029382][ T5920] kasan_save_free_info+0x40/0x50
[ 63.034393][ T5920] __kasan_slab_free+0x59/0x70
[ 63.039142][ T5920] kfree+0x196/0x430
[ 63.043023][ T5920] evict+0x4e8/0x9a0
[ 63.046901][ T5920] __dentry_kill+0x20d/0x630
[ 63.051476][ T5920] shrink_kill+0xa9/0x2c0
[ 63.055793][ T5920] shrink_dentry_list+0x2c0/0x5b0
[ 63.060802][ T5920] shrink_dcache_parent+0xcb/0x3b0
[ 63.065896][ T5920] do_one_tree+0x23/0xe0
[ 63.070120][ T5920] shrink_dcache_for_umount+0xb4/0x180
[ 63.075559][ T5920] generic_shutdown_super+0x6a/0x2d0
[ 63.080830][ T5920] kill_litter_super+0x76/0xb0
[ 63.085582][ T5920] binderfs_kill_super+0x44/0x90
[ 63.090508][ T5920] deactivate_locked_super+0xc4/0x130
[ 63.095874][ T5920] cleanup_mnt+0x41f/0x4b0
[ 63.100271][ T5920] task_work_run+0x24f/0x310
[ 63.104843][ T5920] do_exit+0xa2a/0x28e0
[ 63.108985][ T5920] do_group_exit+0x207/0x2c0
[ 63.113558][ T5920] get_signal+0x168c/0x1720
[ 63.118062][ T5920] arch_do_signal_or_restart+0x96/0x860
[ 63.123595][ T5920] syscall_exit_to_user_mode+0xce/0x340
[ 63.129125][ T5920] do_syscall_64+0x100/0x230
[ 63.133701][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.139668][ T5920]
[ 63.141976][ T5920] The buggy address belongs to the object at ffff888142ba6400
[ 63.141976][ T5920] which belongs to the cache kmalloc-512 of size 512
[ 63.156015][ T5920] The buggy address is located 8 bytes inside of
[ 63.156015][ T5920] freed 512-byte region [ffff888142ba6400, ffff888142ba6600)
[ 63.169621][ T5920]
[ 63.171929][ T5920] The buggy address belongs to the physical page:
[ 63.178332][ T5920] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x142ba4
[ 63.187251][ T5920] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 63.195842][ T5920] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 63.203567][ T5920] page_type: f5(slab)
[ 63.207565][ T5920] raw: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 63.216139][ T5920] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 63.224725][ T5920] head: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 63.233396][ T5920] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 63.242050][ T5920] head: 057ff00000000002 ffffea00050ae901 ffffffffffffffff 0000000000000000
[ 63.250704][ T5920] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 63.259355][ T5920] page dumped because: kasan: bad access detected
[ 63.265761][ T5920] page_owner tracks the page as allocated
[ 63.271543][ T5920] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6844203360, free_ts 0
[ 63.291165][ T5920] post_alloc_hook+0x1f4/0x240
[ 63.295936][ T5920] get_page_from_freelist+0x365c/0x37a0
[ 63.301479][ T5920] __alloc_frozen_pages_noprof+0x292/0x710
[ 63.307271][ T5920] alloc_pages_mpol+0x311/0x660
[ 63.312121][ T5920] allocate_slab+0x8f/0x3a0
[ 63.316621][ T5920] ___slab_alloc+0xc27/0x14a0
[ 63.321293][ T5920] __slab_alloc+0x58/0xa0
[ 63.325615][ T5920] __kmalloc_cache_noprof+0x27b/0x390
[ 63.331076][ T5920] device_add+0xc1/0xbf0
[ 63.335321][ T5920] device_create+0x257/0x2e0
[ 63.339929][ T5920] bdi_register_va+0x8b/0x770
[ 63.344611][ T5920] bdi_register+0xd5/0x120
[ 63.349015][ T5920] add_disk_fwnode+0x759/0xfc0
[ 63.353764][ T5920] brd_alloc+0x59c/0x840
[ 63.357995][ T5920] brd_init+0x126/0x1b0
[ 63.362147][ T5920] do_one_initcall+0x248/0x930
[ 63.366894][ T5920] page_owner free stack trace missing
[ 63.372243][ T5920]
[ 63.374554][ T5920] Memory state around the buggy address:
[ 63.380169][ T5920] ffff888142ba6300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 63.388211][ T5920] ffff888142ba6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 63.396254][ T5920] >ffff888142ba6400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.404299][ T5920] ^
[ 63.408611][ T5920] ffff888142ba6480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.416678][ T5920] ffff888142ba6500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.424717][ T5920] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 63.503321][ T5920] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 63.510557][ T5920] CPU: 0 UID: 0 PID: 5920 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01215-g89d75c4c67ac #0
[ 63.521412][ T5920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 63.531483][ T5920] Call Trace:
[ 63.534753][ T5920]
[ 63.537671][ T5920] dump_stack_lvl+0x241/0x360
[ 63.542427][ T5920] ? __pfx_dump_stack_lvl+0x10/0x10
[ 63.547609][ T5920] ? __pfx__printk+0x10/0x10
[ 63.552181][ T5920] ? preempt_schedule+0xe1/0xf0
[ 63.557021][ T5920] ? vscnprintf+0x5d/0x90
[ 63.561339][ T5920] panic+0x349/0x880
[ 63.565234][ T5920] ? check_panic_on_warn+0x21/0xb0
[ 63.570342][ T5920] ? __pfx_panic+0x10/0x10
[ 63.574744][ T5920] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 63.580708][ T5920] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 63.587016][ T5920] ? print_report+0x519/0x5b0
[ 63.591683][ T5920] check_panic_on_warn+0x86/0xb0
[ 63.596609][ T5920] ? binder_add_device+0x5f/0xa0
[ 63.601539][ T5920] end_report+0x77/0x160
[ 63.605769][ T5920] kasan_report+0x154/0x180
[ 63.610259][ T5920] ? binder_add_device+0x5f/0xa0
[ 63.615190][ T5920] binder_add_device+0x5f/0xa0
[ 63.619945][ T5920] binderfs_binder_device_create+0x878/0xab0
[ 63.625912][ T5920] binderfs_fill_super+0x96e/0xe70
[ 63.631010][ T5920] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.636635][ T5920] ? shrinker_register+0x160/0x230
[ 63.641737][ T5920] ? sget_fc+0x960/0xa50
[ 63.645974][ T5920] ? __pfx_set_anon_super_fc+0x10/0x10
[ 63.651415][ T5920] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.657034][ T5920] get_tree_nodev+0xb7/0x140
[ 63.661642][ T5920] vfs_get_tree+0x90/0x2b0
[ 63.666069][ T5920] do_new_mount+0x2be/0xb40
[ 63.670573][ T5920] ? __pfx_do_new_mount+0x10/0x10
[ 63.675591][ T5920] __se_sys_mount+0x2d6/0x3c0
[ 63.680259][ T5920] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 63.686242][ T5920] ? __pfx___se_sys_mount+0x10/0x10
[ 63.691434][ T5920] ? do_syscall_64+0x100/0x230
[ 63.696185][ T5920] ? __x64_sys_mount+0x20/0xc0
[ 63.700934][ T5920] do_syscall_64+0xf3/0x230
[ 63.705428][ T5920] ? clear_bhb_loop+0x35/0x90
[ 63.710100][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.715990][ T5920] RIP: 0033:0x7fad2db8e90a
[ 63.720392][ T5920] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 63.739986][ T5920] RSP: 002b:00007ffd9ea9b3e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 63.748420][ T5920] RAX: ffffffffffffffda RBX: 00007fad2dc0e663 RCX: 00007fad2db8e90a
[ 63.756377][ T5920] RDX: 00007fad2dc1dda7 RSI: 00007fad2dc0e663 RDI: 00007fad2dc1dda7
[ 63.764348][ T5920] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 63.772303][ T5920] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fad2dc28480
[ 63.780258][ T5920] R13: 00007ffd9ea9b468 R14: 0000000000000009 R15: 0000000000000000
[ 63.788226][ T5920]
[ 63.791483][ T5920] Kernel Offset: disabled
[ 63.795814][ T5920] Rebooting in 86400 seconds..