last executing test programs:

827.633464ms ago: executing program 4 (id=326):
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))

818.886094ms ago: executing program 4 (id=332):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_congestion_control', 0x1, 0x0)

794.014582ms ago: executing program 4 (id=333):
ustat(0x0, &(0x7f0000000000))

748.413601ms ago: executing program 4 (id=336):
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)

687.700459ms ago: executing program 4 (id=341):
mq_open(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000))

687.462381ms ago: executing program 4 (id=344):
rt_sigreturn()

235.937493ms ago: executing program 0 (id=376):
rt_sigpending(&(0x7f0000000000), 0x0)

235.687689ms ago: executing program 3 (id=378):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/onlycap', 0x2, 0x0)

235.554924ms ago: executing program 2 (id=380):
eventfd(0x0)

232.582902ms ago: executing program 0 (id=381):
umount2(&(0x7f0000000000), 0x0)

232.485658ms ago: executing program 2 (id=382):
socket$qrtr(0x2a, 0x2, 0x0)

221.318292ms ago: executing program 0 (id=383):
syz_init_net_socket$llc(0x1a, 0x1, 0x0)

221.260746ms ago: executing program 3 (id=384):
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000), 0x0)

151.857534ms ago: executing program 3 (id=387):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

151.810937ms ago: executing program 2 (id=388):
time(&(0x7f0000000000))

151.702782ms ago: executing program 0 (id=389):
epoll_create(0x0)

151.491991ms ago: executing program 1 (id=390):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/msm', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/msm', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/msm', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/msm', 0x800, 0x0)

151.453912ms ago: executing program 2 (id=391):
timer_create(0x0, &(0x7f0000000000), &(0x7f0000000000))

151.207419ms ago: executing program 3 (id=392):
fanotify_mark(0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000))

142.565251ms ago: executing program 1 (id=393):
syz_init_net_socket$rose(0xb, 0x5, 0x0)

130.943186ms ago: executing program 0 (id=394):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0)

83.873921ms ago: executing program 2 (id=395):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord', 0x800, 0x0)

83.755678ms ago: executing program 1 (id=396):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fb1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb1', 0x800, 0x0)

83.695327ms ago: executing program 3 (id=397):
pkey_free(0xffffffffffffffff)

83.624124ms ago: executing program 0 (id=398):
landlock_restrict_self(0xffffffffffffffff, 0x0)

83.550617ms ago: executing program 2 (id=399):
mlock(0x0, 0x0)

83.470666ms ago: executing program 1 (id=400):
msync(0x0, 0x0, 0x0)

78.170607ms ago: executing program 3 (id=401):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/btf/vmlinux', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/btf/vmlinux', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/btf/vmlinux', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/btf/vmlinux', 0x800, 0x0)

69.536056ms ago: executing program 1 (id=402):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2', 0x800, 0x0)

0s ago: executing program 1 (id=406):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/seq', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/seq', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snd/seq', 0x800, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.108' (ED25519) to the list of known hosts.
syzkaller login: [   58.089240][ T5825] cgroup: Unknown subsys name 'net'
[   58.220845][ T5825] cgroup: Unknown subsys name 'cpuset'
[   58.228639][ T5825] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   59.552831][ T5825] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   61.650632][ T5886] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   64.086191][ T6200] mmap: syz.1.353 (6200) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[   64.212747][ T6208] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   65.151923][ T6254] ==================================================================
[   65.151962][ T6254] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[   65.152014][ T6254] Write of size 8 at addr ffff88814d736c08 by task syz-executor/6254
[   65.152039][ T6254] 
[   65.152074][ T6254] CPU: 0 UID: 0 PID: 6254 Comm: syz-executor Not tainted 6.13.0-rc6-next-20250113-syzkaller #0
[   65.152092][ T6254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   65.152106][ T6254] Call Trace:
[   65.152112][ T6254]  <TASK>
[   65.152119][ T6254]  dump_stack_lvl+0x241/0x3
** replaying previous printk message **
[   65.152119][ T6254]  dump_stack_lvl+0x241/0x360
[   65.152139][ T6254]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.152156][ T6254]  ? __pfx__printk+0x10/0x10
[   65.152180][ T6254]  ? _printk+0xd5/0x120
[   65.152201][ T6254]  ? __virt_addr_valid+0x183/0x530
[   65.152224][ T6254]  ? __virt_addr_valid+0x183/0x530
[   65.152254][ T6254]  print_report+0x169/0x550
[   65.152277][ T6254]  ? __virt_addr_valid+0x183/0x530
[   65.152298][ T6254]  ? __virt_addr_valid+0x183/0x530
[   65.152319][ T6254]  ? __virt_addr_valid+0x45f/0x530
[   65.152340][ T6254]  ? __phys_addr+0xba/0x170
[   65.152362][ T6254]  ? binder_add_device+0x5f/0xa0
[   65.152378][ T6254]  kasan_report+0x143/0x180
[   65.152406][ T6254]  ? binder_add_device+0x5f/0xa0
[   65.152426][ T6254]  binder_add_device+0x5f/0xa0
[   65.152444][ T6254]  binderfs_binder_device_create+0x7bf/0x9c0
[   65.152465][ T6254]  binderfs_fill_super+0x944/0xd90
[   65.152484][ T6254]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.152510][ T6254]  ? shrinker_register+0x160/0x230
[   65.152530][ T6254]  ? sget_fc+0x909/0x9c0
[   65.152551][ T6254]  ? __pfx_set_anon_super_fc+0x10/0x10
[   65.152571][ T6254]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.152587][ T6254]  get_tree_nodev+0xb7/0x140
[   65.152608][ T6254]  vfs_get_tree+0x90/0x2b0
[   65.152630][ T6254]  do_new_mount+0x2be/0xb40
[   65.152648][ T6254]  ? __pfx_do_new_mount+0x10/0x10
[   65.152667][ T6254]  __se_sys_mount+0x2d6/0x3c0
[   65.152684][ T6254]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   65.152705][ T6254]  ? __pfx___se_sys_mount+0x10/0x10
[   65.152722][ T6254]  ? lockdep_hardirqs_on+0x99/0x150
[   65.152743][ T6254]  ? __x64_sys_mount+0x20/0xc0
[   65.152760][ T6254]  do_syscall_64+0xf3/0x230
[   65.152780][ T6254]  ? clear_bhb_loop+0x35/0x90
[   65.152803][ T6254]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.152838][ T6254] RIP: 0033:0x7f1ba01874ca
[   65.152857][ T6254] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.152870][ T6254] RSP: 002b:00007fff7afdb868 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   65.152890][ T6254] RAX: ffffffffffffffda RBX: 00007f1ba0201ecb RCX: 00007f1ba01874ca
[   65.152903][ T6254] RDX: 00007f1ba020ec27 RSI: 00007f1ba0201ecb RDI: 00007f1ba020ec27
[   65.152915][ T6254] RBP: 00007fff7afdb8e0 R08: 0000000000000000 R09: 0000000000000000
[   65.152926][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff7afdb8e0
[   65.152937][ T6254] R13: 00007fff7afdb8e8 R14: 0000000000000009 R15: 0000000000000000
[   65.152954][ T6254]  </TASK>
[   65.152960][ T6254] 
[   65.153295][ T6254] Allocated by task 5838:
[   65.153314][ T6254]  kasan_save_track+0x3f/0x80
[   65.153344][ T6254]  __kasan_kmalloc+0x98/0xb0
[   65.153373][ T6254]  __kmalloc_cache_noprof+0x243/0x390
[   65.153399][ T6254]  binderfs_binder_device_create+0x16c/0x9c0
[   65.153424][ T6254]  binderfs_fill_super+0x944/0xd90
[   65.153448][ T6254]  get_tree_nodev+0xb7/0x140
[   65.153476][ T6254]  vfs_get_tree+0x90/0x2b0
[   65.153505][ T6254]  do_new_mount+0x2be/0xb40
[   65.153529][ T6254]  __se_sys_mount+0x2d6/0x3c0
[   65.153554][ T6254]  do_syscall_64+0xf3/0x230
[   65.153583][ T6254]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.153613][ T6254] 
[   65.153628][ T6254] Freed by task 5838:
[   65.153646][ T6254]  kasan_save_track+0x3f/0x80
[   65.153675][ T6254]  kasan_save_free_info+0x40/0x50
[   65.153701][ T6254]  __kasan_slab_free+0x59/0x70
[   65.153729][ T6254]  kfree+0x196/0x430
[   65.153752][ T6254]  evict+0x4e8/0x9a0
[   65.153779][ T6254]  __dentry_kill+0x20d/0x630
[   65.153805][ T6254]  shrink_kill+0xa9/0x2c0
[   65.153830][ T6254]  shrink_dentry_list+0x2c0/0x5b0
[   65.153856][ T6254]  shrink_dcache_parent+0xcb/0x3b0
[   65.153882][ T6254]  do_one_tree+0x23/0xe0
[   65.153908][ T6254]  shrink_dcache_for_umount+0xb4/0x180
[   65.153935][ T6254]  generic_shutdown_super+0x6a/0x2d0
[   65.153963][ T6254]  kill_litter_super+0x76/0xb0
[   65.153990][ T6254]  binderfs_kill_super+0x44/0x90
[   65.154020][ T6254]  deactivate_locked_super+0xc4/0x130
[   65.154048][ T6254]  cleanup_mnt+0x41f/0x4b0
[   65.154075][ T6254]  task_work_run+0x24f/0x310
[   65.154106][ T6254]  do_exit+0xa2a/0x28e0
[   65.154133][ T6254]  do_group_exit+0x207/0x2c0
[   65.154162][ T6254]  get_signal+0x16b2/0x1750
[   65.154186][ T6254]  arch_do_signal_or_restart+0x96/0x860
[   65.154214][ T6254]  syscall_exit_to_user_mode+0xce/0x340
[   65.154249][ T6254]  do_syscall_64+0x100/0x230
[   65.154277][ T6254]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.154306][ T6254] 
[   65.154318][ T6254] The buggy address belongs to the object at ffff88814d736c00
[   65.154318][ T6254]  which belongs to the cache kmalloc-512 of size 512
[   65.154342][ T6254] The buggy address is located 8 bytes inside of
[   65.154342][ T6254]  freed 512-byte region [ffff88814d736c00, ffff88814d736e00)
[   65.154369][ T6254] 
[   65.154383][ T6254] The buggy address belongs to the physical page:
[   65.154406][ T6254] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d734
[   65.154437][ T6254] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   65.154461][ T6254] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   65.154491][ T6254] page_type: f5(slab)
[   65.154516][ T6254] raw: 057ff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[   65.154539][ T6254] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.154564][ T6254] head: 057ff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[   65.154588][ T6254] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.154612][ T6254] head: 057ff00000000002 ffffea000535cd01 ffffffffffffffff 0000000000000000
[   65.154636][ T6254] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   65.154655][ T6254] page dumped because: kasan: bad access detected
[   65.154677][ T6254] page_owner tracks the page as allocated
[   65.154694][ T6254] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16231121502, free_ts 0
[   65.154735][ T6254]  post_alloc_hook+0x1f4/0x240
[   65.154763][ T6254]  get_page_from_freelist+0x365c/0x37a0
[   65.154794][ T6254]  __alloc_frozen_pages_noprof+0x292/0x710
[   65.154823][ T6254]  alloc_pages_mpol+0x311/0x660
[   65.154855][ T6254]  allocate_slab+0x8f/0x3a0
[   65.154882][ T6254]  ___slab_alloc+0xc27/0x14a0
[   65.154908][ T6254]  __slab_alloc+0x58/0xa0
[   65.154933][ T6254]  __kmalloc_cache_noprof+0x27b/0x390
[   65.154958][ T6254]  crypto_alg_mod_lookup+0x1b3/0x760
[   65.154989][ T6254]  crypto_alloc_tfm_node+0x130/0x360
[   65.155020][ T6254]  init_encrypted+0x44/0x1b0
[   65.155046][ T6254]  do_one_initcall+0x248/0x870
[   65.155071][ T6254]  do_initcall_level+0x157/0x210
[   65.155099][ T6254]  do_initcalls+0x3f/0x80
[   65.155125][ T6254]  kernel_init_freeable+0x435/0x5d0
[   65.155152][ T6254]  kernel_init+0x1d/0x2b0
[   65.155176][ T6254] page_owner free stack trace missing
[   65.155193][ T6254] 
[   65.155207][ T6254] Memory state around the buggy address:
[   65.155227][ T6254]  ffff88814d736b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.155254][ T6254]  ffff88814d736b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.155273][ T6254] >ffff88814d736c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.155286][ T6254]                       ^
[   65.155300][ T6254]  ffff88814d736c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.155315][ T6254]  ffff88814d736d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.155328][ T6254] ==================================================================
[   65.247061][ T6254] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.980135][ T6254] CPU: 0 UID: 0 PID: 6254 Comm: syz-executor Not tainted 6.13.0-rc6-next-20250113-syzkaller #0
[   65.990456][ T6254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   66.000502][ T6254] Call Trace:
[   66.003776][ T6254]  <TASK>
[   66.006703][ T6254]  dump_stack_lvl+0x241/0x360
[   66.011465][ T6254]  ? __pfx_dump_stack_lvl+0x10/0x10
[   66.016658][ T6254]  ? __pfx__printk+0x10/0x10
[   66.021247][ T6254]  ? preempt_schedule+0xe1/0xf0
[   66.026095][ T6254]  ? vscnprintf+0x5d/0x90
[   66.030418][ T6254]  panic+0x349/0x880
[   66.034323][ T6254]  ? check_panic_on_warn+0x21/0xb0
[   66.039447][ T6254]  ? __pfx_panic+0x10/0x10
[   66.043861][ T6254]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   66.049832][ T6254]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   66.056163][ T6254]  ? print_report+0x502/0x550
[   66.060841][ T6254]  check_panic_on_warn+0x86/0xb0
[   66.065990][ T6254]  ? binder_add_device+0x5f/0xa0
[   66.070923][ T6254]  end_report+0x77/0x160
[   66.075165][ T6254]  kasan_report+0x154/0x180
[   66.079671][ T6254]  ? binder_add_device+0x5f/0xa0
[   66.084692][ T6254]  binder_add_device+0x5f/0xa0
[   66.089452][ T6254]  binderfs_binder_device_create+0x7bf/0x9c0
[   66.095515][ T6254]  binderfs_fill_super+0x944/0xd90
[   66.100634][ T6254]  ? __pfx_binderfs_fill_super+0x10/0x10
[   66.106346][ T6254]  ? shrinker_register+0x160/0x230
[   66.111469][ T6254]  ? sget_fc+0x909/0x9c0
[   66.115712][ T6254]  ? __pfx_set_anon_super_fc+0x10/0x10
[   66.121175][ T6254]  ? __pfx_binderfs_fill_super+0x10/0x10
[   66.126799][ T6254]  get_tree_nodev+0xb7/0x140
[   66.131386][ T6254]  vfs_get_tree+0x90/0x2b0
[   66.135799][ T6254]  do_new_mount+0x2be/0xb40
[   66.140296][ T6254]  ? __pfx_do_new_mount+0x10/0x10
[   66.145314][ T6254]  __se_sys_mount+0x2d6/0x3c0
[   66.149994][ T6254]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   66.155968][ T6254]  ? __pfx___se_sys_mount+0x10/0x10
[   66.161169][ T6254]  ? lockdep_hardirqs_on+0x99/0x150
[   66.166367][ T6254]  ? __x64_sys_mount+0x20/0xc0
[   66.171129][ T6254]  do_syscall_64+0xf3/0x230
[   66.175722][ T6254]  ? clear_bhb_loop+0x35/0x90
[   66.180399][ T6254]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.186283][ T6254] RIP: 0033:0x7f1ba01874ca
[   66.190690][ T6254] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   66.210470][ T6254] RSP: 002b:00007fff7afdb868 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   66.218955][ T6254] RAX: ffffffffffffffda RBX: 00007f1ba0201ecb RCX: 00007f1ba01874ca
[   66.226946][ T6254] RDX: 00007f1ba020ec27 RSI: 00007f1ba0201ecb RDI: 00007f1ba020ec27
[   66.234949][ T6254] RBP: 00007fff7afdb8e0 R08: 0000000000000000 R09: 0000000000000000
[   66.242931][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff7afdb8e0
[   66.250908][ T6254] R13: 00007fff7afdb8e8 R14: 0000000000000009 R15: 0000000000000000
[   66.258888][ T6254]  </TASK>
[   67.389913][ T6254] Shutting down cpus with NMI
[   67.395138][ T6254] Kernel Offset: disabled
[   67.399450][ T6254] Rebooting in 86400 seconds..