last executing test programs:
259.015503ms ago: executing program 2 (id=3):
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
246.934863ms ago: executing program 0 (id=1):
fdatasync(0xffffffffffffffff)
237.48903ms ago: executing program 2 (id=7):
socket$nl_rdma(0x10, 0x3, 0x14)
234.169958ms ago: executing program 1 (id=2):
setns(0xffffffffffffffff, 0x0)
164.262586ms ago: executing program 0 (id=8):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bifrost', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bifrost', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bifrost', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bifrost', 0x800, 0x0)
164.080225ms ago: executing program 0 (id=9):
ioperm(0x0, 0x0, 0x0)
163.776893ms ago: executing program 1 (id=10):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0', 0x2, 0x0)
163.012903ms ago: executing program 2 (id=11):
getrlimit(0x0, &(0x7f0000000000))
152.918161ms ago: executing program 4 (id=5):
lchown(&(0x7f0000000000), 0x0, 0x0)
120.855374ms ago: executing program 2 (id=12):
lsm_get_self_attr(0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0)
120.800686ms ago: executing program 3 (id=4):
sched_setattr(0x0, &(0x7f0000000000), 0x0)
76.269809ms ago: executing program 0 (id=13):
nanosleep(&(0x7f0000000000), 0x0)
76.111831ms ago: executing program 4 (id=14):
syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$vim2m(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$vim2m(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$vim2m(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$vim2m(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$vim2m(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$vim2m(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$vim2m(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$vim2m(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$vim2m(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$vim2m(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$vim2m(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$vim2m(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$vim2m(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$vim2m(&(0x7f0000000500), 0x4, 0x800)
76.064444ms ago: executing program 1 (id=15):
exit(0x0)
76.001707ms ago: executing program 5 (id=6):
semtimedop(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000))
66.400753ms ago: executing program 3 (id=16):
fchmodat(0xffffffffffffffff, &(0x7f0000000000), 0x0)
59.130368ms ago: executing program 0 (id=17):
setreuid(0x0, 0x0)
59.056577ms ago: executing program 1 (id=18):
membarrier(0x0, 0x0)
58.313702ms ago: executing program 5 (id=19):
removexattr(&(0x7f0000000000), &(0x7f0000000000))
389.762µs ago: executing program 2 (id=20):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
176.917µs ago: executing program 0 (id=21):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttynull', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttynull', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttynull', 0x800, 0x0)
31.129µs ago: executing program 5 (id=22):
syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)
0s ago: executing program 1 (id=23):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.10.8' (ED25519) to the list of known hosts.
[ 65.467385][ T5817] cgroup: Unknown subsys name 'net'
[ 65.596785][ T5817] cgroup: Unknown subsys name 'cpuset'
[ 65.605030][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 66.982258][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 69.795148][ T5866] ==================================================================
[ 69.803265][ T5866] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 69.811014][ T5866] Write of size 8 at addr ffff888079d75808 by task syz-executor/5866
[ 69.819089][ T5866]
[ 69.821424][ T5866] CPU: 0 UID: 0 PID: 5866 Comm: syz-executor Not tainted 6.13.0-syzkaller-08997-gf34b580514c9 #0
[ 69.821451][ T5866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 69.821466][ T5866] Call Trace:
[ 69.821474][ T5866]
[ 69.821484][ T5866] dump_stack_lvl+0x241/0x360
[ 69.821515][ T5866] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.821546][ T5866] ? __pfx__printk+0x10/0x10
[ 69.821586][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.821625][ T5866] ? _printk+0xd5/0x120
[ 69.821662][ T5866] ? __virt_addr_valid+0x183/0x530
[ 69.821700][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.821740][ T5866] print_report+0x169/0x550
[ 69.821779][ T5866] ? __virt_addr_valid+0x183/0x530
[ 69.821815][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.821853][ T5866] ? __virt_addr_valid+0x45f/0x530
[ 69.821888][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.821925][ T5866] ? __phys_addr+0xba/0x170
[ 69.821962][ T5866] ? binder_add_device+0x5f/0xa0
[ 69.821994][ T5866] kasan_report+0x143/0x180
[ 69.822033][ T5866] ? binder_add_device+0x5f/0xa0
[ 69.822069][ T5866] binder_add_device+0x5f/0xa0
[ 69.822100][ T5866] binderfs_binder_device_create+0x7bf/0x9c0
[ 69.822137][ T5866] binderfs_fill_super+0x944/0xd90
[ 69.822172][ T5866] ? __pfx_binderfs_fill_super+0x10/0x10
[ 69.822215][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.822252][ T5866] ? shrinker_register+0x160/0x230
[ 69.822284][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.822321][ T5866] ? sget_fc+0x909/0x9c0
[ 69.822353][ T5866] ? __pfx_set_anon_super_fc+0x10/0x10
[ 69.822385][ T5866] ? __pfx_binderfs_fill_super+0x10/0x10
[ 69.822416][ T5866] get_tree_nodev+0xb9/0x140
[ 69.822451][ T5866] vfs_get_tree+0x92/0x2b0
[ 69.822510][ T5866] do_new_mount+0x2be/0xb40
[ 69.822541][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.822581][ T5866] ? __pfx_do_new_mount+0x10/0x10
[ 69.822611][ T5866] __se_sys_mount+0x2d6/0x3c0
[ 69.822636][ T5866] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 69.822673][ T5866] ? __pfx___se_sys_mount+0x10/0x10
[ 69.822698][ T5866] ? do_syscall_64+0x100/0x230
[ 69.822737][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 69.822775][ T5866] ? __x64_sys_mount+0x20/0xc0
[ 69.822800][ T5866] do_syscall_64+0xf3/0x230
[ 69.822839][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.822871][ T5866] RIP: 0033:0x7f432f58e4ca
[ 69.822890][ T5866] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 69.822909][ T5866] RSP: 002b:00007ffd5bfb1128 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 69.822934][ T5866] RAX: ffffffffffffffda RBX: 00007f432f60e663 RCX: 00007f432f58e4ca
[ 69.822952][ T5866] RDX: 00007f432f61dd57 RSI: 00007f432f60e663 RDI: 00007f432f61dd57
[ 69.822969][ T5866] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 69.822983][ T5866] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f432f628440
[ 69.822999][ T5866] R13: 00007ffd5bfb11a8 R14: 0000000000000009 R15: 0000000000000000
[ 69.823023][ T5866]
[ 69.823032][ T5866]
[ 70.125288][ T5866] Allocated by task 5834:
[ 70.129616][ T5866] kasan_save_track+0x3f/0x80
[ 70.134309][ T5866] __kasan_kmalloc+0x98/0xb0
[ 70.138966][ T5866] __kmalloc_cache_noprof+0x243/0x390
[ 70.144346][ T5866] binderfs_binder_device_create+0x16c/0x9c0
[ 70.150336][ T5866] binderfs_fill_super+0x944/0xd90
[ 70.155545][ T5866] get_tree_nodev+0xb9/0x140
[ 70.160147][ T5866] vfs_get_tree+0x92/0x2b0
[ 70.164575][ T5866] do_new_mount+0x2be/0xb40
[ 70.169081][ T5866] __se_sys_mount+0x2d6/0x3c0
[ 70.173760][ T5866] do_syscall_64+0xf3/0x230
[ 70.178278][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.184181][ T5866]
[ 70.186498][ T5866] Freed by task 5834:
[ 70.190473][ T5866] kasan_save_track+0x3f/0x80
[ 70.195167][ T5866] kasan_save_free_info+0x40/0x50
[ 70.200199][ T5866] __kasan_slab_free+0x59/0x70
[ 70.204976][ T5866] kfree+0x196/0x430
[ 70.208870][ T5866] evict+0x4ea/0x9a0
[ 70.212774][ T5866] __dentry_kill+0x20d/0x630
[ 70.217465][ T5866] shrink_kill+0xa9/0x2c0
[ 70.221805][ T5866] shrink_dentry_list+0x2c0/0x5b0
[ 70.226868][ T5866] shrink_dcache_parent+0xcb/0x3b0
[ 70.231989][ T5866] do_one_tree+0x23/0xe0
[ 70.236240][ T5866] shrink_dcache_for_umount+0xb4/0x180
[ 70.241707][ T5866] generic_shutdown_super+0x6a/0x2d0
[ 70.247004][ T5866] kill_litter_super+0x76/0xb0
[ 70.251781][ T5866] binderfs_kill_super+0x44/0x90
[ 70.256724][ T5866] deactivate_locked_super+0xc6/0x130
[ 70.262106][ T5866] cleanup_mnt+0x41f/0x4b0
[ 70.266614][ T5866] task_work_run+0x251/0x310
[ 70.271215][ T5866] do_exit+0xa2a/0x28e0
[ 70.275381][ T5866] do_group_exit+0x207/0x2c0
[ 70.279981][ T5866] get_signal+0x16b2/0x1750
[ 70.284483][ T5866] arch_do_signal_or_restart+0x96/0x860
[ 70.290034][ T5866] syscall_exit_to_user_mode+0xce/0x340
[ 70.295593][ T5866] do_syscall_64+0x100/0x230
[ 70.300196][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.306097][ T5866]
[ 70.308415][ T5866] The buggy address belongs to the object at ffff888079d75800
[ 70.308415][ T5866] which belongs to the cache kmalloc-512 of size 512
[ 70.322558][ T5866] The buggy address is located 8 bytes inside of
[ 70.322558][ T5866] freed 512-byte region [ffff888079d75800, ffff888079d75a00)
[ 70.336184][ T5866]
[ 70.338503][ T5866] The buggy address belongs to the physical page:
[ 70.344911][ T5866] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79d74
[ 70.353674][ T5866] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 70.362168][ T5866] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 70.370147][ T5866] page_type: f5(slab)
[ 70.374132][ T5866] raw: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 70.382713][ T5866] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 70.391381][ T5866] head: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 70.400059][ T5866] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 70.408766][ T5866] head: 00fff00000000002 ffffea0001e75d01 ffffffffffffffff 0000000000000000
[ 70.417443][ T5866] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 70.426106][ T5866] page dumped because: kasan: bad access detected
[ 70.432516][ T5866] page_owner tracks the page as allocated
[ 70.438222][ T5866] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5201, tgid 5201 (udevd), ts 39840864038, free_ts 36836372599
[ 70.458985][ T5866] post_alloc_hook+0x1f4/0x240
[ 70.463764][ T5866] get_page_from_freelist+0x365c/0x37a0
[ 70.469326][ T5866] __alloc_frozen_pages_noprof+0x292/0x710
[ 70.475142][ T5866] alloc_pages_mpol+0x311/0x660
[ 70.479989][ T5866] allocate_slab+0x8f/0x3a0
[ 70.484503][ T5866] ___slab_alloc+0xc27/0x14a0
[ 70.489187][ T5866] __slab_alloc+0x58/0xa0
[ 70.493523][ T5866] __kmalloc_cache_noprof+0x27b/0x390
[ 70.498898][ T5866] kernfs_fop_open+0x3e0/0xd10
[ 70.503670][ T5866] do_dentry_open+0xdee/0x1960
[ 70.508432][ T5866] vfs_open+0x3b/0x370
[ 70.512501][ T5866] path_openat+0x2c74/0x3580
[ 70.517097][ T5866] do_filp_open+0x27f/0x4e0
[ 70.521602][ T5866] do_sys_openat2+0x13e/0x1d0
[ 70.526278][ T5866] __x64_sys_openat+0x247/0x2a0
[ 70.531127][ T5866] do_syscall_64+0xf3/0x230
[ 70.535642][ T5866] page last free pid 24 tgid 24 stack trace:
[ 70.541636][ T5866] free_frozen_pages+0xe0d/0x10e0
[ 70.546690][ T5866] __tlb_remove_table+0x33c/0x420
[ 70.551737][ T5866] tlb_remove_table_rcu+0x76/0xf0
[ 70.556788][ T5866] rcu_core+0xaac/0x17a0
[ 70.561047][ T5866] handle_softirqs+0x2d6/0x9b0
[ 70.565823][ T5866] run_ksoftirqd+0xca/0x130
[ 70.570420][ T5866] smpboot_thread_fn+0x546/0xa30
[ 70.575365][ T5866] kthread+0x7ab/0x920
[ 70.579447][ T5866] ret_from_fork+0x4d/0x80
[ 70.583873][ T5866] ret_from_fork_asm+0x1a/0x30
[ 70.588643][ T5866]
[ 70.590959][ T5866] Memory state around the buggy address:
[ 70.596584][ T5866] ffff888079d75700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.604648][ T5866] ffff888079d75780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.612712][ T5866] >ffff888079d75800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 70.620766][ T5866] ^
[ 70.625096][ T5866] ffff888079d75880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 70.633157][ T5866] ffff888079d75900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 70.641212][ T5866] ==================================================================
[ 70.713144][ T5866] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.720395][ T5866] CPU: 0 UID: 0 PID: 5866 Comm: syz-executor Not tainted 6.13.0-syzkaller-08997-gf34b580514c9 #0
[ 70.730909][ T5866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 70.740981][ T5866] Call Trace:
[ 70.744274][ T5866]
[ 70.747215][ T5866] dump_stack_lvl+0x241/0x360
[ 70.751919][ T5866] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.757145][ T5866] ? __pfx__printk+0x10/0x10
[ 70.761770][ T5866] ? preempt_schedule+0xe1/0xf0
[ 70.766657][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.772330][ T5866] ? vscnprintf+0x5d/0x90
[ 70.776683][ T5866] panic+0x349/0x880
[ 70.780619][ T5866] ? check_panic_on_warn+0x21/0xb0
[ 70.785760][ T5866] ? __pfx_panic+0x10/0x10
[ 70.790213][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.796142][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.801809][ T5866] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 70.807814][ T5866] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 70.814169][ T5866] ? print_report+0x502/0x550
[ 70.818879][ T5866] check_panic_on_warn+0x86/0xb0
[ 70.823845][ T5866] ? binder_add_device+0x5f/0xa0
[ 70.828816][ T5866] end_report+0x77/0x160
[ 70.833091][ T5866] kasan_report+0x154/0x180
[ 70.837628][ T5866] ? binder_add_device+0x5f/0xa0
[ 70.842598][ T5866] binder_add_device+0x5f/0xa0
[ 70.847389][ T5866] binderfs_binder_device_create+0x7bf/0x9c0
[ 70.853398][ T5866] binderfs_fill_super+0x944/0xd90
[ 70.858538][ T5866] ? __pfx_binderfs_fill_super+0x10/0x10
[ 70.864205][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.869867][ T5866] ? shrinker_register+0x160/0x230
[ 70.875001][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.880665][ T5866] ? sget_fc+0x909/0x9c0
[ 70.884934][ T5866] ? __pfx_set_anon_super_fc+0x10/0x10
[ 70.890423][ T5866] ? __pfx_binderfs_fill_super+0x10/0x10
[ 70.896083][ T5866] get_tree_nodev+0xb9/0x140
[ 70.900700][ T5866] vfs_get_tree+0x92/0x2b0
[ 70.905146][ T5866] do_new_mount+0x2be/0xb40
[ 70.909664][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.915327][ T5866] ? __pfx_do_new_mount+0x10/0x10
[ 70.920373][ T5866] __se_sys_mount+0x2d6/0x3c0
[ 70.925073][ T5866] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 70.931086][ T5866] ? __pfx___se_sys_mount+0x10/0x10
[ 70.936564][ T5866] ? do_syscall_64+0x100/0x230
[ 70.941365][ T5866] ? srso_alias_return_thunk+0x5/0xfbef5
[ 70.947032][ T5866] ? __x64_sys_mount+0x20/0xc0
[ 70.951814][ T5866] do_syscall_64+0xf3/0x230
[ 70.956348][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.962267][ T5866] RIP: 0033:0x7f432f58e4ca
[ 70.966691][ T5866] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 70.986314][ T5866] RSP: 002b:00007ffd5bfb1128 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 70.994739][ T5866] RAX: ffffffffffffffda RBX: 00007f432f60e663 RCX: 00007f432f58e4ca
[ 71.002719][ T5866] RDX: 00007f432f61dd57 RSI: 00007f432f60e663 RDI: 00007f432f61dd57
[ 71.010782][ T5866] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 71.018754][ T5866] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f432f628440
[ 71.026748][ T5866] R13: 00007ffd5bfb11a8 R14: 0000000000000009 R15: 0000000000000000
[ 71.034733][ T5866]
[ 71.038000][ T5866] Kernel Offset: disabled
[ 71.042318][ T5866] Rebooting in 86400 seconds..