last executing test programs:
1.70784536s ago: executing program 2 (id=200):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fb1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb1', 0x800, 0x0)
1.707356971s ago: executing program 2 (id=204):
getpid()
1.656798162s ago: executing program 2 (id=209):
socket$inet_udp(0x2, 0x2, 0x0)
1.656174121s ago: executing program 2 (id=214):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run', 0x1, 0x0)
1.616013253s ago: executing program 2 (id=220):
socket$nl_route(0x10, 0x3, 0x0)
1.563531164s ago: executing program 2 (id=226):
pause()
202.680794ms ago: executing program 3 (id=403):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control', 0x800, 0x0)
144.47728ms ago: executing program 3 (id=408):
setpriority(0x0, 0x0, 0x0)
144.37816ms ago: executing program 0 (id=409):
exit(0x0)
144.281215ms ago: executing program 3 (id=411):
socket$l2tp6(0xa, 0x2, 0x73)
144.024185ms ago: executing program 0 (id=413):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/rm_contexts', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/rm_contexts', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/rm_contexts', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/rm_contexts', 0x800, 0x0)
107.634676ms ago: executing program 1 (id=414):
setresgid(0x0, 0x0, 0x0)
107.474291ms ago: executing program 4 (id=415):
socket$nl_crypto(0x10, 0x3, 0x15)
107.285187ms ago: executing program 0 (id=416):
getpgrp(0x0)
107.21461ms ago: executing program 4 (id=417):
openat2(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0)
107.143665ms ago: executing program 1 (id=418):
map_shadow_stack(0x0, 0x0, 0x0)
106.878446ms ago: executing program 3 (id=419):
clone3(&(0x7f0000000000), 0x0)
exit(0x0)
106.815229ms ago: executing program 0 (id=420):
userfaultfd(0x0)
106.714522ms ago: executing program 4 (id=421):
fsmount(0xffffffffffffffff, 0x0, 0x0)
56.229786ms ago: executing program 1 (id=422):
mq_timedreceive(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)
55.971222ms ago: executing program 3 (id=423):
syz_init_net_socket$ax25(0x3, 0x2, 0x0)
55.869646ms ago: executing program 4 (id=424):
clock_settime(0x0, &(0x7f0000000000))
55.742731ms ago: executing program 1 (id=425):
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
55.693641ms ago: executing program 0 (id=426):
socket$inet_icmp_raw(0x2, 0x3, 0x1)
55.641215ms ago: executing program 4 (id=427):
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
53.551572ms ago: executing program 3 (id=428):
set_robust_list(&(0x7f0000000000), 0x0)
52.512356ms ago: executing program 1 (id=429):
stat(&(0x7f0000000000), &(0x7f0000000000))
45.077499ms ago: executing program 0 (id=430):
socket$hf(0x13, 0x2, 0x0)
164.44µs ago: executing program 4 (id=431):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/direct', 0x2, 0x0)
0s ago: executing program 1 (id=432):
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.51' (ED25519) to the list of known hosts.
[ 56.957406][ T5822] cgroup: Unknown subsys name 'net'
[ 57.090293][ T5822] cgroup: Unknown subsys name 'cpuset'
[ 57.097538][ T5822] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 58.362627][ T5822] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 60.389536][ T5874] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 60.852875][ T5944] mmap: syz.0.102 (5944) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[ 62.177602][ T6145] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 63.517114][ T6285] ==================================================================
** replaying previous printk message **
[ 63.517114][ T6285] ==================================================================
[ 63.517151][ T6285] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 63.517192][ T6285] Write of size 8 at addr ffff88814045e408 by task syz-executor/6285
[ 63.517215][ T6285]
[ 63.517248][ T6285] CPU: 0 UID: 0 PID: 6285 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250117-syzkaller #0
[ 63.517264][ T6285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 63.517273][ T6285] Call Trace:
[ 63.517278][ T6285]
[ 63.517283][ T6285] dump_stack_lvl+0x241/0x360
[ 63.517299][ T6285] ? __pfx_dump_stack_lvl+0x10/0x10
[ 63.517312][ T6285] ? __pfx__printk+0x10/0x10
[ 63.517330][ T6285] ? _printk+0xd5/0x120
[ 63.517347][ T6285] ? __virt_addr_valid+0x183/0x530
[ 63.517364][ T6285] ? __virt_addr_valid+0x183/0x530
[ 63.517381][ T6285] print_report+0x169/0x550
[ 63.517398][ T6285] ? __virt_addr_valid+0x183/0x530
[ 63.517414][ T6285] ? __virt_addr_valid+0x183/0x530
[ 63.517430][ T6285] ? __virt_addr_valid+0x45f/0x530
[ 63.517446][ T6285] ? __phys_addr+0xba/0x170
[ 63.517463][ T6285] ? binder_add_device+0x5f/0xa0
[ 63.517475][ T6285] kasan_report+0x143/0x180
[ 63.517500][ T6285] ? binder_add_device+0x5f/0xa0
[ 63.517515][ T6285] binder_add_device+0x5f/0xa0
[ 63.517531][ T6285] binderfs_binder_device_create+0x7bf/0x9c0
[ 63.517547][ T6285] binderfs_fill_super+0x944/0xd90
[ 63.517562][ T6285] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.517581][ T6285] ? shrinker_register+0x160/0x230
[ 63.517596][ T6285] ? sget_fc+0x909/0x9c0
[ 63.517611][ T6285] ? __pfx_set_anon_super_fc+0x10/0x10
[ 63.517626][ T6285] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.517638][ T6285] get_tree_nodev+0xb7/0x140
[ 63.517653][ T6285] vfs_get_tree+0x90/0x2b0
[ 63.517669][ T6285] do_new_mount+0x2be/0xb40
[ 63.517689][ T6285] ? __pfx_do_new_mount+0x10/0x10
[ 63.517709][ T6285] __se_sys_mount+0x2d6/0x3c0
[ 63.517720][ T6285] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 63.517738][ T6285] ? __pfx___se_sys_mount+0x10/0x10
[ 63.517751][ T6285] ? do_syscall_64+0x100/0x230
[ 63.517766][ T6285] ? __x64_sys_mount+0x20/0xc0
[ 63.517778][ T6285] do_syscall_64+0xf3/0x230
[ 63.517791][ T6285] ? clear_bhb_loop+0x35/0x90
[ 63.517809][ T6285] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.517828][ T6285] RIP: 0033:0x7f37015874ca
[ 63.517843][ T6285] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 63.517853][ T6285] RSP: 002b:00007ffc28a4df18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 63.517868][ T6285] RAX: ffffffffffffffda RBX: 00007f3701601ecb RCX: 00007f37015874ca
[ 63.517878][ T6285] RDX: 00007f370160ec27 RSI: 00007f3701601ecb RDI: 00007f370160ec27
[ 63.517887][ T6285] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 63.517894][ T6285] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f37016180e0
[ 63.517903][ T6285] R13: 00007ffc28a4df98 R14: 0000000000000009 R15: 0000000000000000
[ 63.517915][ T6285]
[ 63.517920][ T6285]
[ 63.518165][ T6285] Allocated by task 5834:
[ 63.518179][ T6285] kasan_save_track+0x3f/0x80
[ 63.518201][ T6285] __kasan_kmalloc+0x98/0xb0
[ 63.518223][ T6285] __kmalloc_cache_noprof+0x243/0x390
[ 63.518242][ T6285] binderfs_binder_device_create+0x16c/0x9c0
[ 63.518261][ T6285] binderfs_fill_super+0x944/0xd90
[ 63.518279][ T6285] get_tree_nodev+0xb7/0x140
[ 63.518299][ T6285] vfs_get_tree+0x90/0x2b0
[ 63.518320][ T6285] do_new_mount+0x2be/0xb40
[ 63.518343][ T6285] __se_sys_mount+0x2d6/0x3c0
[ 63.518360][ T6285] do_syscall_64+0xf3/0x230
[ 63.518379][ T6285] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.518401][ T6285]
[ 63.518411][ T6285] Freed by task 5834:
[ 63.518424][ T6285] kasan_save_track+0x3f/0x80
[ 63.518445][ T6285] kasan_save_free_info+0x40/0x50
[ 63.518465][ T6285] __kasan_slab_free+0x59/0x70
[ 63.518486][ T6285] kfree+0x196/0x430
[ 63.518510][ T6285] evict+0x4e8/0x9a0
[ 63.518530][ T6285] __dentry_kill+0x20d/0x630
[ 63.518548][ T6285] shrink_kill+0xa9/0x2c0
[ 63.518566][ T6285] shrink_dentry_list+0x2c0/0x5b0
[ 63.518585][ T6285] shrink_dcache_parent+0xcb/0x3b0
[ 63.518604][ T6285] do_one_tree+0x23/0xe0
[ 63.518623][ T6285] shrink_dcache_for_umount+0xb4/0x180
[ 63.518643][ T6285] generic_shutdown_super+0x6a/0x2d0
[ 63.518664][ T6285] kill_litter_super+0x76/0xb0
[ 63.518684][ T6285] binderfs_kill_super+0x44/0x90
[ 63.518701][ T6285] deactivate_locked_super+0xc4/0x130
[ 63.518721][ T6285] cleanup_mnt+0x41f/0x4b0
[ 63.518740][ T6285] task_work_run+0x24f/0x310
[ 63.518764][ T6285] do_exit+0xa2a/0x28e0
[ 63.518785][ T6285] do_group_exit+0x207/0x2c0
[ 63.518806][ T6285] get_signal+0x16b2/0x1750
[ 63.518824][ T6285] arch_do_signal_or_restart+0x96/0x860
[ 63.518845][ T6285] syscall_exit_to_user_mode+0xce/0x340
[ 63.518865][ T6285] do_syscall_64+0x100/0x230
[ 63.518884][ T6285] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.518907][ T6285]
[ 63.518917][ T6285] The buggy address belongs to the object at ffff88814045e400
[ 63.518917][ T6285] which belongs to the cache kmalloc-512 of size 512
[ 63.518936][ T6285] The buggy address is located 8 bytes inside of
[ 63.518936][ T6285] freed 512-byte region [ffff88814045e400, ffff88814045e600)
[ 63.518956][ T6285]
[ 63.518966][ T6285] The buggy address belongs to the physical page:
[ 63.518980][ T6285] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14045c
[ 63.519006][ T6285] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 63.519024][ T6285] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 63.519047][ T6285] page_type: f5(slab)
[ 63.519066][ T6285] raw: 057ff00000000040 ffff88801ac41c80 ffffea000513cf00 dead000000000002
[ 63.519085][ T6285] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 63.519104][ T6285] head: 057ff00000000040 ffff88801ac41c80 ffffea000513cf00 dead000000000002
[ 63.519122][ T6285] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 63.519139][ T6285] head: 057ff00000000002 ffffea0005011701 ffffffffffffffff 0000000000000000
[ 63.519157][ T6285] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 63.519170][ T6285] page dumped because: kasan: bad access detected
[ 63.519187][ T6285] page_owner tracks the page as allocated
[ 63.519200][ T6285] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2649422178, free_ts 0
[ 63.519232][ T6285] post_alloc_hook+0x1f4/0x240
[ 63.519253][ T6285] get_page_from_freelist+0x365c/0x37a0
[ 63.519275][ T6285] __alloc_frozen_pages_noprof+0x292/0x710
[ 63.519297][ T6285] alloc_pages_mpol+0x311/0x660
[ 63.519321][ T6285] allocate_slab+0x8f/0x3a0
[ 63.519341][ T6285] ___slab_alloc+0xc27/0x14a0
[ 63.519361][ T6285] __slab_alloc+0x58/0xa0
[ 63.519380][ T6285] __kmalloc_cache_noprof+0x27b/0x390
[ 63.519399][ T6285] set_kthread_struct+0xc2/0x330
[ 63.519419][ T6285] copy_process+0x11ed/0x3d50
[ 63.519437][ T6285] fork_idle+0xa5/0x270
[ 63.519456][ T6285] idle_threads_init+0x10d/0x1b0
[ 63.519478][ T6285] smp_init+0x18/0x150
[ 63.519507][ T6285] kernel_init_freeable+0x417/0x5d0
[ 63.519527][ T6285] kernel_init+0x1d/0x2b0
[ 63.519548][ T6285] ret_from_fork+0x4b/0x80
[ 63.519569][ T6285] page_owner free stack trace missing
[ 63.519582][ T6285]
[ 63.519592][ T6285] Memory state around the buggy address:
[ 63.519606][ T6285] ffff88814045e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 63.519622][ T6285] ffff88814045e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 63.519638][ T6285] >ffff88814045e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.519652][ T6285] ^
[ 63.519666][ T6285] ffff88814045e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.519681][ T6285] ffff88814045e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.519694][ T6285] ==================================================================
[ 63.527000][ T6285] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 64.309192][ T6285] CPU: 0 UID: 0 PID: 6285 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250117-syzkaller #0
[ 64.319509][ T6285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 64.329553][ T6285] Call Trace:
[ 64.332825][ T6285]
[ 64.335747][ T6285] dump_stack_lvl+0x241/0x360
[ 64.340420][ T6285] ? __pfx_dump_stack_lvl+0x10/0x10
[ 64.345606][ T6285] ? __pfx__printk+0x10/0x10
[ 64.350198][ T6285] ? preempt_schedule+0xe1/0xf0
[ 64.355039][ T6285] ? vscnprintf+0x5d/0x90
[ 64.359366][ T6285] panic+0x349/0x880
[ 64.363256][ T6285] ? check_panic_on_warn+0x21/0xb0
[ 64.368362][ T6285] ? __pfx_panic+0x10/0x10
[ 64.372779][ T6285] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 64.378754][ T6285] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 64.385077][ T6285] ? print_report+0x502/0x550
[ 64.389751][ T6285] check_panic_on_warn+0x86/0xb0
[ 64.394686][ T6285] ? binder_add_device+0x5f/0xa0
[ 64.399627][ T6285] end_report+0x77/0x160
[ 64.403873][ T6285] kasan_report+0x154/0x180
[ 64.408375][ T6285] ? binder_add_device+0x5f/0xa0
[ 64.413307][ T6285] binder_add_device+0x5f/0xa0
[ 64.418060][ T6285] binderfs_binder_device_create+0x7bf/0x9c0
[ 64.424031][ T6285] binderfs_fill_super+0x944/0xd90
[ 64.429135][ T6285] ? __pfx_binderfs_fill_super+0x10/0x10
[ 64.434763][ T6285] ? shrinker_register+0x160/0x230
[ 64.439953][ T6285] ? sget_fc+0x909/0x9c0
[ 64.444192][ T6285] ? __pfx_set_anon_super_fc+0x10/0x10
[ 64.449645][ T6285] ? __pfx_binderfs_fill_super+0x10/0x10
[ 64.455277][ T6285] get_tree_nodev+0xb7/0x140
[ 64.459863][ T6285] vfs_get_tree+0x90/0x2b0
[ 64.464271][ T6285] do_new_mount+0x2be/0xb40
[ 64.468772][ T6285] ? __pfx_do_new_mount+0x10/0x10
[ 64.473884][ T6285] __se_sys_mount+0x2d6/0x3c0
[ 64.478555][ T6285] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 64.484532][ T6285] ? __pfx___se_sys_mount+0x10/0x10
[ 64.489724][ T6285] ? do_syscall_64+0x100/0x230
[ 64.494481][ T6285] ? __x64_sys_mount+0x20/0xc0
[ 64.499235][ T6285] do_syscall_64+0xf3/0x230
[ 64.503731][ T6285] ? clear_bhb_loop+0x35/0x90
[ 64.508403][ T6285] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.514290][ T6285] RIP: 0033:0x7f37015874ca
[ 64.518702][ T6285] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 64.538333][ T6285] RSP: 002b:00007ffc28a4df18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 64.546829][ T6285] RAX: ffffffffffffffda RBX: 00007f3701601ecb RCX: 00007f37015874ca
[ 64.554794][ T6285] RDX: 00007f370160ec27 RSI: 00007f3701601ecb RDI: 00007f370160ec27
[ 64.562768][ T6285] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 64.570745][ T6285] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f37016180e0
[ 64.578710][ T6285] R13: 00007ffc28a4df98 R14: 0000000000000009 R15: 0000000000000000
[ 64.586687][ T6285]
[ 65.713959][ T6285] Shutting down cpus with NMI
[ 65.719093][ T6285] Kernel Offset: disabled
[ 65.723406][ T6285] Rebooting in 86400 seconds..