Warning: Permanently added '10.128.0.140' (ED25519) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 81.381867][ T5823] ==================================================================
[ 81.389967][ T5823] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 81.397709][ T5823] Write of size 8 at addr ffff88814531e408 by task syz-executor122/5823
[ 81.406021][ T5823]
[ 81.408335][ T5823] CPU: 1 UID: 0 PID: 5823 Comm: syz-executor122 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full)
[ 81.408359][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
[ 81.408371][ T5823] Call Trace:
[ 81.408379][ T5823]
[ 81.408387][ T5823] dump_stack_lvl+0x189/0x250
[ 81.408420][ T5823] ? __kasan_check_byte+0x12/0x40
[ 81.408454][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 81.408483][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 81.408507][ T5823] ? lock_release+0x4b/0x3e0
[ 81.408535][ T5823] ? lock_release+0x4b/0x3e0
[ 81.408566][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 81.408590][ T5823] ? __virt_addr_valid+0x469/0x540
[ 81.408619][ T5823] print_report+0xb4/0x290
[ 81.408644][ T5823] ? binder_add_device+0x5f/0xa0
[ 81.408670][ T5823] kasan_report+0x118/0x150
[ 81.408695][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 81.408721][ T5823] ? binder_add_device+0x5f/0xa0
[ 81.408751][ T5823] binder_add_device+0x5f/0xa0
[ 81.408778][ T5823] binderfs_binder_device_create+0x8b7/0xaf0
[ 81.408810][ T5823] binderfs_fill_super+0xa0e/0xe90
[ 81.408840][ T5823] ? __pfx_binderfs_fill_super+0x10/0x10
[ 81.408879][ T5823] ? shrinker_register+0x16b/0x230
[ 81.408901][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 81.408924][ T5823] ? sget_fc+0x962/0xa40
[ 81.408944][ T5823] ? __pfx_set_anon_super_fc+0x10/0x10
[ 81.408964][ T5823] ? __pfx_binderfs_fill_super+0x10/0x10
[ 81.408990][ T5823] get_tree_nodev+0xbb/0x150
[ 81.409012][ T5823] vfs_get_tree+0x92/0x2b0
[ 81.409037][ T5823] do_new_mount+0x24a/0xa40
[ 81.409067][ T5823] __se_sys_mount+0x317/0x410
[ 81.409097][ T5823] ? __pfx___se_sys_mount+0x10/0x10
[ 81.409129][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 81.409152][ T5823] ? __x64_sys_mount+0x20/0xc0
[ 81.409180][ T5823] do_syscall_64+0xf6/0x210
[ 81.409206][ T5823] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 81.409230][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 81.409250][ T5823] RIP: 0033:0x7f4a4fc556da
[ 81.409266][ T5823] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 8e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 81.409283][ T5823] RSP: 002b:00007fffcef906b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 81.409304][ T5823] RAX: ffffffffffffffda RBX: 00007f4a4fcab038 RCX: 00007f4a4fc556da
[ 81.409319][ T5823] RDX: 00007f4a4fcab1b8 RSI: 00007f4a4fcab038 RDI: 00007f4a4fcab1b8
[ 81.409334][ T5823] RBP: 00007f4a4fcab188 R08: 0000000000000000 R09: 0000000000000140
[ 81.409347][ T5823] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4a4fcb135c
[ 81.409360][ T5823] R13: 00007f4a4fcab0f0 R14: 0000000000000001 R15: 0000000000000001
[ 81.409382][ T5823]
[ 81.409389][ T5823]
[ 81.677162][ T5823] Allocated by task 5819:
[ 81.681478][ T5823] kasan_save_track+0x3e/0x80
[ 81.686152][ T5823] __kasan_kmalloc+0x93/0xb0
[ 81.690735][ T5823] __kmalloc_cache_noprof+0x230/0x3d0
[ 81.696102][ T5823] binderfs_binder_device_create+0x17f/0xaf0
[ 81.702080][ T5823] binderfs_fill_super+0xa0e/0xe90
[ 81.707187][ T5823] get_tree_nodev+0xbb/0x150
[ 81.711853][ T5823] vfs_get_tree+0x92/0x2b0
[ 81.716266][ T5823] do_new_mount+0x24a/0xa40
[ 81.720763][ T5823] __se_sys_mount+0x317/0x410
[ 81.725437][ T5823] do_syscall_64+0xf6/0x210
[ 81.729935][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 81.735820][ T5823]
[ 81.738130][ T5823] Freed by task 10:
[ 81.741919][ T5823] kasan_save_track+0x3e/0x80
[ 81.746587][ T5823] kasan_save_free_info+0x46/0x50
[ 81.751612][ T5823] __kasan_slab_free+0x62/0x70
[ 81.756367][ T5823] kfree+0x193/0x440
[ 81.760254][ T5823] binder_proc_dec_tmpref+0x228/0x4f0
[ 81.765621][ T5823] binder_deferred_func+0x13a5/0x1520
[ 81.770983][ T5823] process_scheduled_works+0xade/0x17a0
[ 81.776528][ T5823] worker_thread+0x8a0/0xda0
[ 81.781106][ T5823] kthread+0x711/0x8a0
[ 81.785170][ T5823] ret_from_fork+0x4e/0x80
[ 81.789610][ T5823] ret_from_fork_asm+0x1a/0x30
[ 81.794364][ T5823]
[ 81.796674][ T5823] The buggy address belongs to the object at ffff88814531e400
[ 81.796674][ T5823] which belongs to the cache kmalloc-512 of size 512
[ 81.810715][ T5823] The buggy address is located 8 bytes inside of
[ 81.810715][ T5823] freed 512-byte region [ffff88814531e400, ffff88814531e600)
[ 81.824329][ T5823]
[ 81.826639][ T5823] The buggy address belongs to the physical page:
[ 81.833031][ T5823] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14531c
[ 81.841865][ T5823] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 81.850352][ T5823] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 81.858404][ T5823] page_type: f5(slab)
[ 81.862377][ T5823] raw: 057ff00000000040 ffff88801a041c80 0000000000000000 dead000000000001
[ 81.870949][ T5823] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 81.879520][ T5823] head: 057ff00000000040 ffff88801a041c80 0000000000000000 dead000000000001
[ 81.888179][ T5823] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 81.896838][ T5823] head: 057ff00000000002 ffffea000514c701 00000000ffffffff 00000000ffffffff
[ 81.905506][ T5823] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 81.914163][ T5823] page dumped because: kasan: bad access detected
[ 81.920561][ T5823] page_owner tracks the page as allocated
[ 81.926256][ T5823] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10665197320, free_ts 0
[ 81.944392][ T5823] post_alloc_hook+0x1d8/0x230
[ 81.949155][ T5823] get_page_from_freelist+0x21ce/0x22b0
[ 81.954701][ T5823] __alloc_frozen_pages_noprof+0x181/0x370
[ 81.960511][ T5823] alloc_pages_mpol+0x232/0x4a0
[ 81.965359][ T5823] allocate_slab+0x8a/0x3b0
[ 81.969846][ T5823] ___slab_alloc+0xbfc/0x1480
[ 81.974525][ T5823] __kmalloc_cache_noprof+0x296/0x3d0
[ 81.979894][ T5823] usb_cache_string+0x66/0x130
[ 81.984662][ T5823] usb_new_device+0x361/0x16c0
[ 81.989424][ T5823] register_root_hub+0x275/0x590
[ 81.994353][ T5823] usb_add_hcd+0xba1/0x1050
[ 81.998848][ T5823] dummy_hcd_probe+0x134/0x270
[ 82.003605][ T5823] platform_probe+0x148/0x1d0
[ 82.008275][ T5823] really_probe+0x26d/0x9a0
[ 82.012773][ T5823] __driver_probe_device+0x18c/0x2f0
[ 82.018053][ T5823] driver_probe_device+0x4f/0x430
[ 82.023073][ T5823] page_owner free stack trace missing
[ 82.028423][ T5823]
[ 82.030733][ T5823] Memory state around the buggy address:
[ 82.036347][ T5823] ffff88814531e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 82.044396][ T5823] ffff88814531e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 82.052444][ T5823] >ffff88814531e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 82.060491][ T5823] ^
[ 82.064803][ T5823] ffff88814531e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 82.072853][ T5823] ffff88814531e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
executing program
[ 82.080988][ T5823] ==================================================================
[ 82.100924][ T5823] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 82.108132][ T5823] CPU: 1 UID: 0 PID: 5823 Comm: syz-executor122 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full)
[ 82.120548][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
[ 82.130604][ T5823] Call Trace:
executing program
[ 82.133885][ T5823]
[ 82.136819][ T5823] dump_stack_lvl+0x99/0x250
[ 82.141435][ T5823] ? __asan_memcpy+0x40/0x70
[ 82.146035][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 82.151255][ T5823] ? __pfx__printk+0x10/0x10
[ 82.155859][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 82.161509][ T5823] panic+0x2db/0x790
[ 82.165423][ T5823] ? __pfx_preempt_schedule+0x10/0x10
[ 82.170811][ T5823] ? __pfx_panic+0x10/0x10
[ 82.175241][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
executing program
executing program
executing program
[ 82.180890][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 82.186538][ T5823] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 82.192457][ T5823] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 82.198783][ T5823] ? binder_add_device+0x5f/0xa0
[ 82.203732][ T5823] check_panic_on_warn+0x89/0xb0
[ 82.208670][ T5823] ? binder_add_device+0x5f/0xa0
[ 82.213627][ T5823] end_report+0x78/0x160
[ 82.217881][ T5823] kasan_report+0x129/0x150
[ 82.222382][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 82.228029][ T5823] ? binder_add_device+0x5f/0xa0
executing program
executing program
executing program
executing program
[ 82.232981][ T5823] binder_add_device+0x5f/0xa0
[ 82.237751][ T5823] binderfs_binder_device_create+0x8b7/0xaf0
[ 82.243746][ T5823] binderfs_fill_super+0xa0e/0xe90
[ 82.248864][ T5823] ? __pfx_binderfs_fill_super+0x10/0x10
[ 82.254524][ T5823] ? shrinker_register+0x16b/0x230
[ 82.259640][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 82.265274][ T5823] ? sget_fc+0x962/0xa40
[ 82.269527][ T5823] ? __pfx_set_anon_super_fc+0x10/0x10
[ 82.274994][ T5823] ? __pfx_binderfs_fill_super+0x10/0x10
[ 82.280642][ T5823] get_tree_nodev+0xbb/0x150
executing program
[ 82.285238][ T5823] vfs_get_tree+0x92/0x2b0
[ 82.289653][ T5823] do_new_mount+0x24a/0xa40
[ 82.294178][ T5823] __se_sys_mount+0x317/0x410
[ 82.298869][ T5823] ? __pfx___se_sys_mount+0x10/0x10
[ 82.304075][ T5823] ? srso_alias_return_thunk+0x5/0xfbef5
[ 82.310422][ T5823] ? __x64_sys_mount+0x20/0xc0
[ 82.315290][ T5823] do_syscall_64+0xf6/0x210
[ 82.319798][ T5823] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 82.325960][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 82.331850][ T5823] RIP: 0033:0x7f4a4fc556da
[ 82.336273][ T5823] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 8e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 82.355968][ T5823] RSP: 002b:00007fffcef906b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 82.364382][ T5823] RAX: ffffffffffffffda RBX: 00007f4a4fcab038 RCX: 00007f4a4fc556da
[ 82.372357][ T5823] RDX: 00007f4a4fcab1b8 RSI: 00007f4a4fcab038 RDI: 00007f4a4fcab1b8
[ 82.380327][ T5823] RBP: 00007f4a4fcab188 R08: 0000000000000000 R09: 0000000000000140
[ 82.388386][ T5823] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4a4fcb135c
[ 82.396354][ T5823] R13: 00007f4a4fcab0f0 R14: 0000000000000001 R15: 0000000000000001
[ 82.404335][ T5823]
[ 82.407440][ T5823] Kernel Offset: disabled
[ 82.411754][ T5823] Rebooting in 86400 seconds..