Warning: Permanently added '[localhost]:5722' (ED25519) to the list of known hosts.
executing program
[ 69.810255][ T785] ==================================================================
[ 69.813307][ T785] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x2f/0x140
[ 69.816750][ T785] Read of size 8 at addr ffff888043350b08 by task kworker/0:2/785
[ 69.820539][ T785]
[ 69.821469][ T785] CPU: 0 UID: 0 PID: 785 Comm: kworker/0:2 Not tainted 6.12.0-rc6-syzkaller-00192-gf1dce1f09380 #0
[ 69.825375][ T785] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.829444][ T785] Workqueue: events binder_deferred_func
[ 69.831662][ T785] Call Trace:
[ 69.832930][ T785]
[ 69.834002][ T785] dump_stack_lvl+0x241/0x360
[ 69.835837][ T785] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.837894][ T785] ? __pfx__printk+0x10/0x10
[ 69.839676][ T785] ? _printk+0xd5/0x120
[ 69.841278][ T785] ? __virt_addr_valid+0x183/0x530
[ 69.843286][ T785] ? __virt_addr_valid+0x183/0x530
[ 69.845317][ T785] print_report+0x169/0x550
[ 69.847100][ T785] ? __virt_addr_valid+0x183/0x530
[ 69.849081][ T785] ? __virt_addr_valid+0x183/0x530
[ 69.851017][ T785] ? __virt_addr_valid+0x45f/0x530
[ 69.852952][ T785] ? __phys_addr+0xba/0x170
[ 69.854739][ T785] ? __list_del_entry_valid_or_report+0x2f/0x140
[ 69.857197][ T785] kasan_report+0x143/0x180
[ 69.858900][ T785] ? __list_del_entry_valid_or_report+0x2f/0x140
[ 69.861331][ T785] __list_del_entry_valid_or_report+0x2f/0x140
[ 69.863737][ T785] binder_release_work+0xc7/0x480
[ 69.865749][ T785] binder_deferred_func+0x1275/0x1460
[ 69.867700][ T785] ? process_scheduled_works+0x976/0x1850
[ 69.869778][ T785] process_scheduled_works+0xa63/0x1850
[ 69.871895][ T785] ? __pfx_process_scheduled_works+0x10/0x10
[ 69.874218][ T785] ? assign_work+0x364/0x3d0
[ 69.875930][ T785] worker_thread+0x870/0xd30
[ 69.877612][ T785] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 69.879822][ T785] ? __kthread_parkme+0x169/0x1d0
[ 69.881690][ T785] ? __pfx_worker_thread+0x10/0x10
[ 69.883663][ T785] kthread+0x2f0/0x390
[ 69.885161][ T785] ? __pfx_worker_thread+0x10/0x10
[ 69.887132][ T785] ? __pfx_kthread+0x10/0x10
[ 69.888795][ T785] ret_from_fork+0x4b/0x80
[ 69.890450][ T785] ? __pfx_kthread+0x10/0x10
[ 69.892186][ T785] ret_from_fork_asm+0x1a/0x30
[ 69.894003][ T785]
[ 69.895200][ T785]
[ 69.896131][ T785] Allocated by task 5317:
[ 69.897761][ T785] kasan_save_track+0x3f/0x80
[ 69.899550][ T785] __kasan_kmalloc+0x98/0xb0
[ 69.901342][ T785] __kmalloc_cache_noprof+0x19c/0x2c0
[ 69.903408][ T785] binder_ioctl_write_read+0xe7f/0xb560
[ 69.905505][ T785] binder_ioctl+0x436/0x1cc0
[ 69.907297][ T785] __se_sys_ioctl+0xf9/0x170
[ 69.909091][ T785] do_syscall_64+0xf3/0x230
[ 69.910809][ T785] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.913068][ T785]
[ 69.913944][ T785] Freed by task 785:
[ 69.915381][ T785] kasan_save_track+0x3f/0x80
[ 69.917187][ T785] kasan_save_free_info+0x40/0x50
[ 69.919114][ T785] __kasan_slab_free+0x59/0x70
[ 69.920910][ T785] kfree+0x1a0/0x440
[ 69.922424][ T785] binder_deferred_func+0x11df/0x1460
[ 69.924481][ T785] process_scheduled_works+0xa63/0x1850
[ 69.926650][ T785] worker_thread+0x870/0xd30
[ 69.928400][ T785] kthread+0x2f0/0x390
[ 69.929972][ T785] ret_from_fork+0x4b/0x80
[ 69.931677][ T785] ret_from_fork_asm+0x1a/0x30
[ 69.933425][ T785]
[ 69.934316][ T785] The buggy address belongs to the object at ffff888043350b00
[ 69.934316][ T785] which belongs to the cache kmalloc-64 of size 64
[ 69.939304][ T785] The buggy address is located 8 bytes inside of
[ 69.939304][ T785] freed 64-byte region [ffff888043350b00, ffff888043350b40)
[ 69.944290][ T785]
[ 69.945186][ T785] The buggy address belongs to the physical page:
[ 69.947569][ T785] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43350
[ 69.950688][ T785] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 69.953319][ T785] page_type: f5(slab)
[ 69.954946][ T785] raw: 04fff00000000000 ffff88801ac418c0 dead000000000122 0000000000000000
[ 69.958398][ T785] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[ 69.961598][ T785] page dumped because: kasan: bad access detected
[ 69.963992][ T785] page_owner tracks the page as allocated
[ 69.966103][ T785] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5314, tgid 5314 (syz-executor325), ts 69804248083, free_ts 69418629406
[ 69.973170][ T785] post_alloc_hook+0x1f3/0x230
[ 69.974970][ T785] get_page_from_freelist+0x303f/0x3190
[ 69.977033][ T785] __alloc_pages_noprof+0x292/0x710
[ 69.978973][ T785] alloc_pages_mpol_noprof+0x3e8/0x680
[ 69.981015][ T785] alloc_slab_page+0x6a/0x140
[ 69.982793][ T785] allocate_slab+0x5a/0x2f0
[ 69.984517][ T785] ___slab_alloc+0xcd1/0x14b0
[ 69.986259][ T785] __slab_alloc+0x58/0xa0
[ 69.987867][ T785] __kmalloc_noprof+0x25a/0x400
[ 69.989785][ T785] tomoyo_get_name+0x202/0x520
[ 69.991631][ T785] tomoyo_parse_name_union+0x14a/0x1c0
[ 69.993505][ T785] tomoyo_write_file+0x36c/0xe50
[ 69.995364][ T785] tomoyo_write_domain2+0x1e0/0x250
[ 69.997258][ T785] tomoyo_supervisor+0xf09/0x11f0
[ 69.999173][ T785] tomoyo_path_permission+0x243/0x360
[ 70.001058][ T785] tomoyo_path_perm+0x460/0x740
[ 70.002714][ T785] page last free pid 5311 tgid 5311 stack trace:
[ 70.004857][ T785] free_unref_page+0xcfb/0xf20
[ 70.006646][ T785] __slab_free+0x31b/0x3d0
[ 70.008340][ T785] qlist_free_all+0x9a/0x140
[ 70.010087][ T785] kasan_quarantine_reduce+0x14f/0x170
[ 70.012100][ T785] __kasan_slab_alloc+0x23/0x80
[ 70.014000][ T785] kmem_cache_alloc_noprof+0x135/0x2a0
[ 70.016030][ T785] getname_flags+0xb7/0x540
[ 70.017662][ T785] vfs_fstatat+0x12c/0x190
[ 70.019272][ T785] __x64_sys_newfstatat+0x11d/0x1a0
[ 70.021064][ T785] do_syscall_64+0xf3/0x230
[ 70.022782][ T785] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.024949][ T785]
[ 70.025792][ T785] Memory state around the buggy address:
[ 70.027929][ T785] ffff888043350a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.030693][ T785] ffff888043350a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.033662][ T785] >ffff888043350b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.036874][ T785] ^
[ 70.038667][ T785] ffff888043350b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.041592][ T785] ffff888043350c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.044536][ T785] ==================================================================
[ 70.047729][ T785] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.050444][ T785] CPU: 0 UID: 0 PID: 785 Comm: kworker/0:2 Not tainted 6.12.0-rc6-syzkaller-00192-gf1dce1f09380 #0
[ 70.054116][ T785] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 70.058050][ T785] Workqueue: events binder_deferred_func
[ 70.060173][ T785] Call Trace:
[ 70.061386][ T785]
[ 70.062561][ T785] dump_stack_lvl+0x241/0x360
[ 70.064329][ T785] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.066243][ T785] ? __pfx__printk+0x10/0x10
[ 70.068035][ T785] ? lock_release+0xbf/0xa30
[ 70.069810][ T785] ? vscnprintf+0x5d/0x90
[ 70.071417][ T785] panic+0x349/0x880
[ 70.072871][ T785] ? check_panic_on_warn+0x21/0xb0
[ 70.074759][ T785] ? __pfx_panic+0x10/0x10
[ 70.076456][ T785] ? mark_lock+0x9a/0x360
[ 70.078066][ T785] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 70.080310][ T785] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 70.082469][ T785] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 70.084715][ T785] ? print_report+0x502/0x550
[ 70.086415][ T785] check_panic_on_warn+0x86/0xb0
[ 70.088196][ T785] ? __list_del_entry_valid_or_report+0x2f/0x140
[ 70.090466][ T785] end_report+0x77/0x160
[ 70.091979][ T785] kasan_report+0x154/0x180
[ 70.093706][ T785] ? __list_del_entry_valid_or_report+0x2f/0x140
[ 70.096079][ T785] __list_del_entry_valid_or_report+0x2f/0x140
[ 70.098471][ T785] binder_release_work+0xc7/0x480
[ 70.100388][ T785] binder_deferred_func+0x1275/0x1460
[ 70.102269][ T785] ? process_scheduled_works+0x976/0x1850
[ 70.104238][ T785] process_scheduled_works+0xa63/0x1850
[ 70.106281][ T785] ? __pfx_process_scheduled_works+0x10/0x10
[ 70.108814][ T785] ? assign_work+0x364/0x3d0
[ 70.110795][ T785] worker_thread+0x870/0xd30
[ 70.112513][ T785] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 70.114627][ T785] ? __kthread_parkme+0x169/0x1d0
[ 70.116450][ T785] ? __pfx_worker_thread+0x10/0x10
[ 70.118288][ T785] kthread+0x2f0/0x390
[ 70.119843][ T785] ? __pfx_worker_thread+0x10/0x10
[ 70.121719][ T785] ? __pfx_kthread+0x10/0x10
[ 70.123486][ T785] ret_from_fork+0x4b/0x80
[ 70.125077][ T785] ? __pfx_kthread+0x10/0x10
[ 70.126693][ T785] ret_from_fork_asm+0x1a/0x30
[ 70.128454][ T785]
[ 70.129842][ T785] Kernel Offset: disabled
[ 70.131442][ T785] Rebooting in 86400 seconds..
VM DIAGNOSIS:
03:12:46 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000038 RBX=ffffffff9a719ec0 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc900019072b0
R8 =ffffffff854af69b R9 =1ffff11003d58046 R10=dffffc0000000000 R11=ffffffff854af650
R12=dffffc0000000000 R13=ffffffff9a414f05 R14=0000000000000038 R15=00000000000003f8
RIP=ffffffff854af6ce RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88801fc00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f00a2d690d0 CR3=00000000430b8000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000ffe000d0 Opmask01=0000000000000001 Opmask02=00000000fff7ffff Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 65646e69622f7366 7265646e69622f2e
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffccd207250 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f00a2d71240 00007f00a2d65558
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f00a2d57264 00007f00a2d6a240
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7865006a64615f65 726f63735f6d6f6f 2f666c65732f636f 72702f0030303031
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5d40004f41445f40 574a46565f484a4a 0a434940560a464a 57550a0015151514
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000