last executing test programs:

877.656508ms ago: executing program 3 (id=4):
lsetxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0)

806.135904ms ago: executing program 3 (id=12):
socket$vsock_dgram(0x28, 0x2, 0x0)

805.644235ms ago: executing program 3 (id=17):
connect(0xffffffffffffffff, &(0x7f0000000000), 0x0)

791.426508ms ago: executing program 3 (id=21):
socket(0x1, 0x1, 0x0)

417.910899ms ago: executing program 1 (id=66):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0)

416.964044ms ago: executing program 1 (id=68):
pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

346.079791ms ago: executing program 4 (id=73):
open(&(0x7f0000000000), 0x0, 0x0)

345.973862ms ago: executing program 1 (id=75):
get_robust_list(0x0, &(0x7f0000000000), &(0x7f0000000000))

344.255193ms ago: executing program 1 (id=77):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20', 0x800, 0x0)

338.398352ms ago: executing program 4 (id=78):
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0)

277.819726ms ago: executing program 1 (id=81):
memfd_create(&(0x7f0000000000), 0x0)

277.628356ms ago: executing program 3 (id=26):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/raw-gadget', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/raw-gadget', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/raw-gadget', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/raw-gadget', 0x800, 0x0)

277.3328ms ago: executing program 4 (id=83):
setxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0)

267.780828ms ago: executing program 1 (id=84):
read(0xffffffffffffffff, &(0x7f0000000000), 0x0)

256.532083ms ago: executing program 4 (id=85):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/oss_mixer', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/card0/oss_mixer', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card0/oss_mixer', 0x800, 0x0)

193.926749ms ago: executing program 0 (id=89):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock', 0x2, 0x0)

191.426669ms ago: executing program 2 (id=90):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/userio', 0x800, 0x0)

160.006935ms ago: executing program 4 (id=92):
sched_setaffinity(0x0, 0x0, &(0x7f0000000000))

106.149737ms ago: executing program 2 (id=93):
socket$inet(0x2, 0x1, 0x0)

105.961864ms ago: executing program 0 (id=94):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci', 0x800, 0x0)

105.92507ms ago: executing program 4 (id=95):
socket$inet_mptcp(0x2, 0x1, 0x106)

105.858218ms ago: executing program 0 (id=96):
pkey_free(0xffffffffffffffff)

94.457205ms ago: executing program 2 (id=97):
lchown(&(0x7f0000000000), 0x0, 0x0)

85.008955ms ago: executing program 0 (id=98):
restart_syscall()

15.426187ms ago: executing program 2 (id=100):
fstatfs(0xffffffffffffffff, &(0x7f0000000000))

15.295432ms ago: executing program 0 (id=101):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/trusty-ipc-dev0', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/trusty-ipc-dev0', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/trusty-ipc-dev0', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/trusty-ipc-dev0', 0x800, 0x0)

15.132798ms ago: executing program 2 (id=102):
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

5.895086ms ago: executing program 0 (id=103):
quotactl$Q_GETFMT(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000))

0s ago: executing program 2 (id=104):
renameat(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000))

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.0.245' (ED25519) to the list of known hosts.
[   59.955733][ T5817] cgroup: Unknown subsys name 'net'
[   60.081562][ T5817] cgroup: Unknown subsys name 'cpuset'
[   60.089441][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   61.467430][ T5817] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.272800][ T5932] ==================================================================
[   64.280920][ T5932] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[   64.288788][ T5932] Write of size 8 at addr ffff8880329df008 by task syz-executor/5932
[   64.296987][ T5932] 
[   64.299723][ T5932] CPU: 1 UID: 0 PID: 5932 Comm: syz-executor Not tainted 6.13.0-syzkaller-08997-gf34b580514c9 #0
[   64.299744][ T5932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   64.299756][ T5932] Call Trace:
[   64.299762][ T5932]  <TASK>
[   64.299769][ T5932]  dump_stack_lvl+0x241/0x360
[   64.299791][ T5932]  ? __pfx_dump_stack_lvl+0x10/0x10
[   64.299805][ T5932]  ? __pfx__printk+0x10/0x10
[   64.299827][ T5932]  ? _printk+0xd5/0x120
[   64.299847][ T5932]  ? __virt_addr_valid+0x183/0x530
[   64.299868][ T5932]  ? __virt_addr_valid+0x183/0x530
[   64.299890][ T5932]  print_report+0x169/0x550
[   64.299914][ T5932]  ? __virt_addr_valid+0x183/0x530
[   64.299933][ T5932]  ? __virt_addr_valid+0x183/0x530
[   64.299951][ T5932]  ? __virt_addr_valid+0x45f/0x530
[   64.299971][ T5932]  ? __phys_addr+0xba/0x170
[   64.299991][ T5932]  ? binder_add_device+0x5f/0xa0
[   64.300009][ T5932]  kasan_report+0x143/0x180
[   64.300031][ T5932]  ? binder_add_device+0x5f/0xa0
[   64.300052][ T5932]  binder_add_device+0x5f/0xa0
[   64.300070][ T5932]  binderfs_binder_device_create+0x7bf/0x9c0
[   64.300091][ T5932]  binderfs_fill_super+0x944/0xd90
[   64.300112][ T5932]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.300138][ T5932]  ? shrinker_register+0x160/0x230
[   64.300158][ T5932]  ? sget_fc+0x909/0x9c0
[   64.300177][ T5932]  ? __pfx_set_anon_super_fc+0x10/0x10
[   64.300196][ T5932]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.300216][ T5932]  get_tree_nodev+0xb7/0x140
[   64.300234][ T5932]  vfs_get_tree+0x90/0x2b0
[   64.300253][ T5932]  do_new_mount+0x2be/0xb40
[   64.300271][ T5932]  ? __pfx_do_new_mount+0x10/0x10
[   64.300290][ T5932]  __se_sys_mount+0x2d6/0x3c0
[   64.300305][ T5932]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   64.300327][ T5932]  ? __pfx___se_sys_mount+0x10/0x10
[   64.300343][ T5932]  ? do_syscall_64+0x100/0x230
[   64.300367][ T5932]  ? __x64_sys_mount+0x20/0xc0
[   64.300383][ T5932]  do_syscall_64+0xf3/0x230
[   64.300403][ T5932]  ? clear_bhb_loop+0x35/0x90
[   64.300424][ T5932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.300444][ T5932] RIP: 0033:0x7fad2e78e4ca
[   64.300479][ T5932] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   64.300490][ T5932] RSP: 002b:00007fffb65d2e18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   64.300507][ T5932] RAX: ffffffffffffffda RBX: 00007fad2e80e663 RCX: 00007fad2e78e4ca
[   64.300519][ T5932] RDX: 00007fad2e81dd57 RSI: 00007fad2e80e663 RDI: 00007fad2e81dd57
[   64.300529][ T5932] RBP: 00007fad2e80e85b R08: 0000000000000000 R09: 00000000000001ff
[   64.300538][ T5932] R10: 0000000000000000 R11: 0000000000000246 R12: 000055555b7824a8
[   64.300548][ T5932] R13: 00007fffb65d2ec8 R14: 0000000000000009 R15: 0000000000000000
[   64.300564][ T5932]  </TASK>
[   64.300570][ T5932] 
[   64.574635][ T5932] Allocated by task 5878:
[   64.579033][ T5932]  kasan_save_track+0x3f/0x80
[   64.583740][ T5932]  __kasan_kmalloc+0x98/0xb0
[   64.588382][ T5932]  __kmalloc_cache_noprof+0x243/0x390
[   64.593781][ T5932]  binderfs_binder_device_create+0x16c/0x9c0
[   64.599908][ T5932]  binderfs_fill_super+0x944/0xd90
[   64.605051][ T5932]  get_tree_nodev+0xb7/0x140
[   64.609683][ T5932]  vfs_get_tree+0x90/0x2b0
[   64.614475][ T5932]  do_new_mount+0x2be/0xb40
[   64.619264][ T5932]  __se_sys_mount+0x2d6/0x3c0
[   64.624066][ T5932]  do_syscall_64+0xf3/0x230
[   64.628770][ T5932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.634861][ T5932] 
[   64.637337][ T5932] Freed by task 5878:
[   64.641349][ T5932]  kasan_save_track+0x3f/0x80
[   64.646050][ T5932]  kasan_save_free_info+0x40/0x50
[   64.651104][ T5932]  __kasan_slab_free+0x59/0x70
[   64.655905][ T5932]  kfree+0x196/0x430
[   64.659825][ T5932]  evict+0x4e8/0x9a0
[   64.663747][ T5932]  __dentry_kill+0x20d/0x630
[   64.668461][ T5932]  shrink_kill+0xa9/0x2c0
[   64.672842][ T5932]  shrink_dentry_list+0x2c0/0x5b0
[   64.677896][ T5932]  shrink_dcache_parent+0xcb/0x3b0
[   64.683129][ T5932]  do_one_tree+0x23/0xe0
[   64.687433][ T5932]  shrink_dcache_for_umount+0xb4/0x180
[   64.692917][ T5932]  generic_shutdown_super+0x6a/0x2d0
[   64.698320][ T5932]  kill_litter_super+0x76/0xb0
[   64.703100][ T5932]  binderfs_kill_super+0x44/0x90
[   64.708069][ T5932]  deactivate_locked_super+0xc4/0x130
[   64.713473][ T5932]  cleanup_mnt+0x41f/0x4b0
[   64.717947][ T5932]  task_work_run+0x24f/0x310
[   64.722598][ T5932]  do_exit+0xa2a/0x28e0
[   64.726781][ T5932]  do_group_exit+0x207/0x2c0
[   64.731398][ T5932]  get_signal+0x16b2/0x1750
[   64.735967][ T5932]  arch_do_signal_or_restart+0x96/0x860
[   64.741536][ T5932]  syscall_exit_to_user_mode+0xce/0x340
[   64.747121][ T5932]  do_syscall_64+0x100/0x230
[   64.751745][ T5932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.758190][ T5932] 
[   64.760527][ T5932] The buggy address belongs to the object at ffff8880329df000
[   64.760527][ T5932]  which belongs to the cache kmalloc-512 of size 512
[   64.774596][ T5932] The buggy address is located 8 bytes inside of
[   64.774596][ T5932]  freed 512-byte region [ffff8880329df000, ffff8880329df200)
[   64.788322][ T5932] 
[   64.790682][ T5932] The buggy address belongs to the physical page:
[   64.797118][ T5932] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x329dc
[   64.805949][ T5932] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   64.814503][ T5932] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   64.822082][ T5932] page_type: f5(slab)
[   64.826091][ T5932] raw: 00fff00000000040 ffff88801ac41c80 ffffea0000d25500 dead000000000002
[   64.835125][ T5932] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   64.843728][ T5932] head: 00fff00000000040 ffff88801ac41c80 ffffea0000d25500 dead000000000002
[   64.852421][ T5932] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   64.861117][ T5932] head: 00fff00000000002 ffffea0000ca7701 ffffffffffffffff 0000000000000000
[   64.869804][ T5932] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   64.878490][ T5932] page dumped because: kasan: bad access detected
[   64.884940][ T5932] page_owner tracks the page as allocated
[   64.890680][ T5932] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5206, tgid 5206 (udevadm), ts 23138041891, free_ts 23123564850
[   64.911683][ T5932]  post_alloc_hook+0x1f4/0x240
[   64.916475][ T5932]  get_page_from_freelist+0x365c/0x37a0
[   64.922050][ T5932]  __alloc_frozen_pages_noprof+0x292/0x710
[   64.927907][ T5932]  alloc_pages_mpol+0x311/0x660
[   64.932866][ T5932]  allocate_slab+0x8f/0x3a0
[   64.937400][ T5932]  ___slab_alloc+0xc27/0x14a0
[   64.942099][ T5932]  __slab_alloc+0x58/0xa0
[   64.946715][ T5932]  __kmalloc_cache_noprof+0x27b/0x390
[   64.952145][ T5932]  kernfs_fop_open+0x3e0/0xd10
[   64.956933][ T5932]  do_dentry_open+0xdec/0x1960
[   64.961713][ T5932]  vfs_open+0x3b/0x370
[   64.965814][ T5932]  path_openat+0x2c74/0x3580
[   64.970577][ T5932]  do_filp_open+0x27f/0x4e0
[   64.975125][ T5932]  do_sys_openat2+0x13e/0x1d0
[   64.979851][ T5932]  __x64_sys_openat+0x247/0x2a0
[   64.984833][ T5932]  do_syscall_64+0xf3/0x230
[   64.989376][ T5932] page last free pid 5206 tgid 5206 stack trace:
[   64.995732][ T5932]  free_frozen_pages+0xe0d/0x10e0
[   65.000773][ T5932]  __put_partials+0x160/0x1c0
[   65.005678][ T5932]  put_cpu_partial+0x17c/0x250
[   65.010637][ T5932]  __slab_free+0x290/0x380
[   65.015265][ T5932]  qlist_free_all+0x9a/0x140
[   65.019892][ T5932]  kasan_quarantine_reduce+0x14f/0x170
[   65.025380][ T5932]  __kasan_slab_alloc+0x23/0x80
[   65.030261][ T5932]  __kmalloc_noprof+0x236/0x4c0
[   65.035143][ T5932]  kernfs_fop_write_iter+0x15a/0x500
[   65.040532][ T5932]  vfs_write+0xacf/0xd10
[   65.044794][ T5932]  ksys_write+0x18f/0x2b0
[   65.049146][ T5932]  do_syscall_64+0xf3/0x230
[   65.053671][ T5932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.059598][ T5932] 
[   65.061938][ T5932] Memory state around the buggy address:
[   65.067579][ T5932]  ffff8880329def00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.075705][ T5932]  ffff8880329def80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.083790][ T5932] >ffff8880329df000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.091862][ T5932]                       ^
[   65.096201][ T5932]  ffff8880329df080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.104280][ T5932]  ffff8880329df100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.112365][ T5932] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   65.123108][ T5932] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.130424][ T5932] CPU: 1 UID: 0 PID: 5932 Comm: syz-executor Not tainted 6.13.0-syzkaller-08997-gf34b580514c9 #0
[   65.140942][ T5932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   65.151107][ T5932] Call Trace:
[   65.154416][ T5932]  <TASK>
[   65.157367][ T5932]  dump_stack_lvl+0x241/0x360
[   65.162155][ T5932]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.167376][ T5932]  ? __pfx__printk+0x10/0x10
[   65.172120][ T5932]  ? preempt_schedule+0xe1/0xf0
[   65.176999][ T5932]  ? vscnprintf+0x5d/0x90
[   65.181381][ T5932]  panic+0x349/0x880
[   65.185268][ T5932]  ? check_panic_on_warn+0x21/0xb0
[   65.190479][ T5932]  ? __pfx_panic+0x10/0x10
[   65.194914][ T5932]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   65.200894][ T5932]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   65.207212][ T5932]  ? print_report+0x502/0x550
[   65.211896][ T5932]  check_panic_on_warn+0x86/0xb0
[   65.216860][ T5932]  ? binder_add_device+0x5f/0xa0
[   65.221794][ T5932]  end_report+0x77/0x160
[   65.226121][ T5932]  kasan_report+0x154/0x180
[   65.230620][ T5932]  ? binder_add_device+0x5f/0xa0
[   65.235813][ T5932]  binder_add_device+0x5f/0xa0
[   65.240799][ T5932]  binderfs_binder_device_create+0x7bf/0x9c0
[   65.246880][ T5932]  binderfs_fill_super+0x944/0xd90
[   65.252008][ T5932]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.257641][ T5932]  ? shrinker_register+0x160/0x230
[   65.263223][ T5932]  ? sget_fc+0x909/0x9c0
[   65.267539][ T5932]  ? __pfx_set_anon_super_fc+0x10/0x10
[   65.273007][ T5932]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.278726][ T5932]  get_tree_nodev+0xb7/0x140
[   65.283397][ T5932]  vfs_get_tree+0x90/0x2b0
[   65.287801][ T5932]  do_new_mount+0x2be/0xb40
[   65.292305][ T5932]  ? __pfx_do_new_mount+0x10/0x10
[   65.297334][ T5932]  __se_sys_mount+0x2d6/0x3c0
[   65.302014][ T5932]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   65.308000][ T5932]  ? __pfx___se_sys_mount+0x10/0x10
[   65.313307][ T5932]  ? do_syscall_64+0x100/0x230
[   65.318132][ T5932]  ? __x64_sys_mount+0x20/0xc0
[   65.323159][ T5932]  do_syscall_64+0xf3/0x230
[   65.328177][ T5932]  ? clear_bhb_loop+0x35/0x90
[   65.332851][ T5932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.338737][ T5932] RIP: 0033:0x7fad2e78e4ca
[   65.343132][ T5932] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.362831][ T5932] RSP: 002b:00007fffb65d2e18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   65.371250][ T5932] RAX: ffffffffffffffda RBX: 00007fad2e80e663 RCX: 00007fad2e78e4ca
[   65.379317][ T5932] RDX: 00007fad2e81dd57 RSI: 00007fad2e80e663 RDI: 00007fad2e81dd57
[   65.387300][ T5932] RBP: 00007fad2e80e85b R08: 0000000000000000 R09: 00000000000001ff
[   65.395283][ T5932] R10: 0000000000000000 R11: 0000000000000246 R12: 000055555b7824a8
[   65.403252][ T5932] R13: 00007fffb65d2ec8 R14: 0000000000000009 R15: 0000000000000000
[   65.411303][ T5932]  </TASK>
[   65.414670][ T5932] Kernel Offset: disabled
[   65.419006][ T5932] Rebooting in 86400 seconds..