last executing test programs:
237.059169ms ago: executing program 1 (id=136):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ocfs2_control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ocfs2_control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ocfs2_control', 0x800, 0x0)
236.802237ms ago: executing program 3 (id=139):
getrusage(0x0, &(0x7f0000000000))
198.736353ms ago: executing program 1 (id=141):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/virtual_nci', 0x2, 0x0)
198.515993ms ago: executing program 3 (id=143):
pread64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
198.317885ms ago: executing program 0 (id=145):
mq_unlink(&(0x7f0000000000))
151.958025ms ago: executing program 4 (id=146):
socket$igmp(0x2, 0x3, 0x2)
151.640912ms ago: executing program 3 (id=147):
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
151.322733ms ago: executing program 2 (id=148):
landlock_create_ruleset(&(0x7f0000000000), 0x0, 0x0)
151.164484ms ago: executing program 0 (id=149):
setns(0xffffffffffffffff, 0x0)
151.092622ms ago: executing program 4 (id=150):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs', 0x800, 0x0)
150.923091ms ago: executing program 0 (id=151):
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
146.746687ms ago: executing program 3 (id=152):
getdents(0xffffffffffffffff, &(0x7f0000000000), 0x0)
104.118732ms ago: executing program 2 (id=153):
process_mrelease(0xffffffffffffffff, 0x0)
103.939365ms ago: executing program 1 (id=154):
lsm_list_modules(&(0x7f0000000000), &(0x7f0000000000), 0x0)
103.716799ms ago: executing program 4 (id=155):
brk(0x0)
103.64199ms ago: executing program 2 (id=156):
truncate(&(0x7f0000000000), 0x0)
103.496331ms ago: executing program 4 (id=157):
fstatfs(0xffffffffffffffff, &(0x7f0000000000))
103.383058ms ago: executing program 3 (id=158):
fgetxattr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0)
99.638194ms ago: executing program 1 (id=159):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net', 0x2, 0x0)
96.432502ms ago: executing program 0 (id=160):
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
47.465127ms ago: executing program 2 (id=161):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_congestion_control', 0x1, 0x0)
47.36441ms ago: executing program 3 (id=162):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mali0', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mali0', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mali0', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mali0', 0x800, 0x0)
47.295539ms ago: executing program 4 (id=163):
socket$tipc(0x1e, 0x2, 0x0)
47.243904ms ago: executing program 0 (id=164):
setgroups(0x0, &(0x7f0000000000))
47.198538ms ago: executing program 2 (id=165):
open(&(0x7f0000000000), 0x0, 0x0)
47.104885ms ago: executing program 1 (id=166):
socket(0x1, 0x1, 0x0)
46.943228ms ago: executing program 0 (id=167):
timer_delete(0x0)
46.814288ms ago: executing program 4 (id=168):
socket$can_j1939(0x1d, 0x2, 0x7)
138.076µs ago: executing program 1 (id=169):
flock(0xffffffffffffffff, 0x0)
0s ago: executing program 2 (id=170):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid', 0x800, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.10.15' (ED25519) to the list of known hosts.
[ 57.352446][ T5824] cgroup: Unknown subsys name 'net'
[ 57.487596][ T5824] cgroup: Unknown subsys name 'cpuset'
[ 57.495268][ T5824] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 58.861814][ T5824] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 62.246382][ T6026] ==================================================================
[ 62.246419][ T6026] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 62.246470][ T6026] Write of size 8 at addr ffff88802bb90808 by task syz-executor/6026
[ 62.246494][ T6026]
[ 62.246526][ T6026] CPU: 1 UID: 0 PID: 6026 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250115-syzkaller #0
[ 62.246542][ T6026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 62.246552][ T6026] Call Trace:
[ 62.246558][ T6026]
[ 62.246565][ T6026] dump_stack_lvl+0x241/0x360
[ 62.246583][ T6026] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.246600][ T6026] ? __pfx_
** replaying previous printk message **
[ 62.246600][ T6026] ? __pfx__printk+0x10/0x10
[ 62.246623][ T6026] ? _printk+0xd5/0x120
[ 62.246645][ T6026] ? __virt_addr_valid+0x183/0x530
[ 62.246667][ T6026] ? __virt_addr_valid+0x183/0x530
[ 62.246690][ T6026] print_report+0x169/0x550
[ 62.246712][ T6026] ? __virt_addr_valid+0x183/0x530
[ 62.246733][ T6026] ? __virt_addr_valid+0x183/0x530
[ 62.246753][ T6026] ? __virt_addr_valid+0x45f/0x530
[ 62.246774][ T6026] ? __phys_addr+0xba/0x170
[ 62.246796][ T6026] ? binder_add_device+0x5f/0xa0
[ 62.246813][ T6026] kasan_report+0x143/0x180
[ 62.246843][ T6026] ? binder_add_device+0x5f/0xa0
[ 62.246864][ T6026] binder_add_device+0x5f/0xa0
[ 62.246883][ T6026] binderfs_binder_device_create+0x7bf/0x9c0
[ 62.246905][ T6026] binderfs_fill_super+0x944/0xd90
[ 62.246926][ T6026] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.246952][ T6026] ? shrinker_register+0x160/0x230
[ 62.246972][ T6026] ? sget_fc+0x909/0x9c0
[ 62.246991][ T6026] ? __pfx_set_anon_super_fc+0x10/0x10
[ 62.247010][ T6026] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.247028][ T6026] get_tree_nodev+0xb7/0x140
[ 62.247048][ T6026] vfs_get_tree+0x90/0x2b0
[ 62.247069][ T6026] do_new_mount+0x2be/0xb40
[ 62.247087][ T6026] ? __pfx_do_new_mount+0x10/0x10
[ 62.247106][ T6026] __se_sys_mount+0x2d6/0x3c0
[ 62.247121][ T6026] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 62.247143][ T6026] ? __pfx___se_sys_mount+0x10/0x10
[ 62.247158][ T6026] ? do_syscall_64+0x100/0x230
[ 62.247178][ T6026] ? __x64_sys_mount+0x20/0xc0
[ 62.247194][ T6026] do_syscall_64+0xf3/0x230
[ 62.247212][ T6026] ? clear_bhb_loop+0x35/0x90
[ 62.247235][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.247261][ T6026] RIP: 0033:0x7fe60f7874ca
[ 62.247280][ T6026] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 62.247293][ T6026] RSP: 002b:00007ffe539a5438 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 62.247317][ T6026] RAX: ffffffffffffffda RBX: 00007fe60f801ecb RCX: 00007fe60f7874ca
[ 62.247329][ T6026] RDX: 00007fe60f80ec27 RSI: 00007fe60f801ecb RDI: 00007fe60f80ec27
[ 62.247341][ T6026] RBP: 00007fe60f8020c3 R08: 0000000000000000 R09: 00007ffe539a54e0
[ 62.247352][ T6026] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe60f7e41c8
[ 62.247363][ T6026] R13: 00007fe60f7e41a8 R14: 0000000000000009 R15: 0000000000000000
[ 62.247380][ T6026]
[ 62.247386][ T6026]
[ 62.247705][ T6026] Allocated by task 5837:
[ 62.247724][ T6026] kasan_save_track+0x3f/0x80
[ 62.247753][ T6026] __kasan_kmalloc+0x98/0xb0
[ 62.247783][ T6026] __kmalloc_cache_noprof+0x243/0x390
[ 62.247808][ T6026] binderfs_binder_device_create+0x16c/0x9c0
[ 62.247843][ T6026] binderfs_fill_super+0x944/0xd90
[ 62.247869][ T6026] get_tree_nodev+0xb7/0x140
[ 62.247896][ T6026] vfs_get_tree+0x90/0x2b0
[ 62.247924][ T6026] do_new_mount+0x2be/0xb40
[ 62.247946][ T6026] __se_sys_mount+0x2d6/0x3c0
[ 62.247970][ T6026] do_syscall_64+0xf3/0x230
[ 62.247996][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.248025][ T6026]
[ 62.248040][ T6026] Freed by task 5837:
[ 62.248056][ T6026] kasan_save_track+0x3f/0x80
[ 62.248085][ T6026] kasan_save_free_info+0x40/0x50
[ 62.248110][ T6026] __kasan_slab_free+0x59/0x70
[ 62.248139][ T6026] kfree+0x196/0x430
[ 62.248162][ T6026] evict+0x4e8/0x9a0
[ 62.248188][ T6026] __dentry_kill+0x20d/0x630
[ 62.248214][ T6026] shrink_kill+0xa9/0x2c0
[ 62.248238][ T6026] shrink_dentry_list+0x2c0/0x5b0
[ 62.248262][ T6026] shrink_dcache_parent+0xcb/0x3b0
[ 62.248288][ T6026] do_one_tree+0x23/0xe0
[ 62.248313][ T6026] shrink_dcache_for_umount+0xb4/0x180
[ 62.248340][ T6026] generic_shutdown_super+0x6a/0x2d0
[ 62.248367][ T6026] kill_litter_super+0x76/0xb0
[ 62.248394][ T6026] binderfs_kill_super+0x44/0x90
[ 62.248419][ T6026] deactivate_locked_super+0xc4/0x130
[ 62.248444][ T6026] cleanup_mnt+0x41f/0x4b0
[ 62.248469][ T6026] task_work_run+0x24f/0x310
[ 62.248499][ T6026] do_exit+0xa2a/0x28e0
[ 62.248527][ T6026] do_group_exit+0x207/0x2c0
[ 62.248555][ T6026] get_signal+0x16b2/0x1750
[ 62.248578][ T6026] arch_do_signal_or_restart+0x96/0x860
[ 62.248605][ T6026] syscall_exit_to_user_mode+0xce/0x340
[ 62.248632][ T6026] do_syscall_64+0x100/0x230
[ 62.248657][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.248685][ T6026]
[ 62.248700][ T6026] The buggy address belongs to the object at ffff88802bb90800
[ 62.248700][ T6026] which belongs to the cache kmalloc-512 of size 512
[ 62.248723][ T6026] The buggy address is located 8 bytes inside of
[ 62.248723][ T6026] freed 512-byte region [ffff88802bb90800, ffff88802bb90a00)
[ 62.248750][ T6026]
[ 62.248764][ T6026] The buggy address belongs to the physical page:
[ 62.248786][ T6026] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802bb91000 pfn:0x2bb90
[ 62.248815][ T6026] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 62.248844][ T6026] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 62.248873][ T6026] page_type: f5(slab)
[ 62.248897][ T6026] raw: 00fff00000000040 ffff88801ac41c80 ffffea0000d06800 dead000000000002
[ 62.248919][ T6026] raw: ffff88802bb91000 000000000010000f 00000000f5000000 0000000000000000
[ 62.248941][ T6026] head: 00fff00000000040 ffff88801ac41c80 ffffea0000d06800 dead000000000002
[ 62.248963][ T6026] head: ffff88802bb91000 000000000010000f 00000000f5000000 0000000000000000
[ 62.248984][ T6026] head: 00fff00000000002 ffffea0000aee401 ffffffffffffffff 0000000000000000
[ 62.249006][ T6026] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 62.249023][ T6026] page dumped because: kasan: bad access detected
[ 62.249046][ T6026] page_owner tracks the page as allocated
[ 62.249066][ T6026] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5226, tgid 5226 (udevadm), ts 21185795300, free_ts 21172921902
[ 62.249107][ T6026] post_alloc_hook+0x1f4/0x240
[ 62.249134][ T6026] get_page_from_freelist+0x365c/0x37a0
[ 62.249164][ T6026] __alloc_frozen_pages_noprof+0x292/0x710
[ 62.249193][ T6026] alloc_pages_mpol+0x311/0x660
[ 62.249224][ T6026] allocate_slab+0x8f/0x3a0
[ 62.249251][ T6026] ___slab_alloc+0xc27/0x14a0
[ 62.249275][ T6026] __slab_alloc+0x58/0xa0
[ 62.249298][ T6026] __kmalloc_cache_noprof+0x27b/0x390
[ 62.249323][ T6026] kernfs_fop_open+0x3e0/0xd10
[ 62.249349][ T6026] do_dentry_open+0xdec/0x1960
[ 62.249370][ T6026] vfs_open+0x3b/0x370
[ 62.249390][ T6026] path_openat+0x2c74/0x3580
[ 62.249416][ T6026] do_filp_open+0x27f/0x4e0
[ 62.249440][ T6026] do_sys_openat2+0x13e/0x1d0
[ 62.249461][ T6026] __x64_sys_openat+0x247/0x2a0
[ 62.249484][ T6026] do_syscall_64+0xf3/0x230
[ 62.249510][ T6026] page last free pid 5223 tgid 5223 stack trace:
[ 62.249528][ T6026] free_frozen_pages+0xe0d/0x10e0
[ 62.249551][ T6026] __put_partials+0x160/0x1c0
[ 62.249575][ T6026] put_cpu_partial+0x17c/0x250
[ 62.249600][ T6026] __slab_free+0x290/0x380
[ 62.249627][ T6026] qlist_free_all+0x9a/0x140
[ 62.249653][ T6026] kasan_quarantine_reduce+0x14f/0x170
[ 62.249678][ T6026] __kasan_slab_alloc+0x23/0x80
[ 62.249706][ T6026] kmem_cache_alloc_noprof+0x1d9/0x380
[ 62.249728][ T6026] getname_flags+0xb7/0x540
[ 62.249750][ T6026] do_readlinkat+0xd8/0x3a0
[ 62.249775][ T6026] __x64_sys_readlink+0x7f/0x90
[ 62.249799][ T6026] do_syscall_64+0xf3/0x230
[ 62.249831][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.249860][ T6026]
[ 62.249874][ T6026] Memory state around the buggy address:
[ 62.249891][ T6026] ffff88802bb90700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.249910][ T6026] ffff88802bb90780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.249931][ T6026] >ffff88802bb90800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.249948][ T6026] ^
[ 62.249966][ T6026] ffff88802bb90880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.249986][ T6026] ffff88802bb90900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.250003][ T6026] ==================================================================
[ 62.326372][ T6026] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 63.116846][ T6026] CPU: 0 UID: 0 PID: 6026 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250115-syzkaller #0
[ 63.127254][ T6026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 63.137324][ T6026] Call Trace:
[ 63.140614][ T6026]
[ 63.143566][ T6026] dump_stack_lvl+0x241/0x360
[ 63.148245][ T6026] ? __pfx_dump_stack_lvl+0x10/0x10
[ 63.153609][ T6026] ? __pfx__printk+0x10/0x10
[ 63.158198][ T6026] ? preempt_schedule+0xe1/0xf0
[ 63.163044][ T6026] ? vscnprintf+0x5d/0x90
[ 63.167434][ T6026] panic+0x349/0x880
[ 63.171329][ T6026] ? check_panic_on_warn+0x21/0xb0
[ 63.176438][ T6026] ? __pfx_panic+0x10/0x10
[ 63.180855][ T6026] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 63.186828][ T6026] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 63.193148][ T6026] ? print_report+0x502/0x550
[ 63.197826][ T6026] check_panic_on_warn+0x86/0xb0
[ 63.202774][ T6026] ? binder_add_device+0x5f/0xa0
[ 63.207711][ T6026] end_report+0x77/0x160
[ 63.211951][ T6026] kasan_report+0x154/0x180
[ 63.216458][ T6026] ? binder_add_device+0x5f/0xa0
[ 63.221483][ T6026] binder_add_device+0x5f/0xa0
[ 63.226242][ T6026] binderfs_binder_device_create+0x7bf/0x9c0
[ 63.232229][ T6026] binderfs_fill_super+0x944/0xd90
[ 63.237422][ T6026] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.243068][ T6026] ? shrinker_register+0x160/0x230
[ 63.248180][ T6026] ? sget_fc+0x909/0x9c0
[ 63.252428][ T6026] ? __pfx_set_anon_super_fc+0x10/0x10
[ 63.257880][ T6026] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.263525][ T6026] get_tree_nodev+0xb7/0x140
[ 63.268107][ T6026] vfs_get_tree+0x90/0x2b0
[ 63.272523][ T6026] do_new_mount+0x2be/0xb40
[ 63.277105][ T6026] ? __pfx_do_new_mount+0x10/0x10
[ 63.282122][ T6026] __se_sys_mount+0x2d6/0x3c0
[ 63.286874][ T6026] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 63.293024][ T6026] ? __pfx___se_sys_mount+0x10/0x10
[ 63.298297][ T6026] ? do_syscall_64+0x100/0x230
[ 63.303073][ T6026] ? __x64_sys_mount+0x20/0xc0
[ 63.307827][ T6026] do_syscall_64+0xf3/0x230
[ 63.312327][ T6026] ? clear_bhb_loop+0x35/0x90
[ 63.317008][ T6026] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.322896][ T6026] RIP: 0033:0x7fe60f7874ca
[ 63.327305][ T6026] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 63.346986][ T6026] RSP: 002b:00007ffe539a5438 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 63.355483][ T6026] RAX: ffffffffffffffda RBX: 00007fe60f801ecb RCX: 00007fe60f7874ca
[ 63.363447][ T6026] RDX: 00007fe60f80ec27 RSI: 00007fe60f801ecb RDI: 00007fe60f80ec27
[ 63.371586][ T6026] RBP: 00007fe60f8020c3 R08: 0000000000000000 R09: 00007ffe539a54e0
[ 63.379579][ T6026] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe60f7e41c8
[ 63.387580][ T6026] R13: 00007fe60f7e41a8 R14: 0000000000000009 R15: 0000000000000000
[ 63.395554][ T6026]
[ 64.531801][ T6026] Shutting down cpus with NMI
[ 64.536972][ T6026] Kernel Offset: disabled
[ 64.541418][ T6026] Rebooting in 86400 seconds..