last executing test programs:
2.639277643s ago: executing program 1 (id=2):
bind(0xffffffffffffffff, &(0x7f0000000000), 0x0)
2.559523932s ago: executing program 1 (id=14):
socket$nl_netfilter(0x10, 0x3, 0xc)
2.554476219s ago: executing program 1 (id=20):
ptrace(0x0, 0x0)
2.479256714s ago: executing program 1 (id=23):
pause()
259.614242ms ago: executing program 4 (id=313):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/schemes', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/schemes', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/schemes', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/schemes', 0x800, 0x0)
195.460951ms ago: executing program 2 (id=315):
fremovexattr(0xffffffffffffffff, &(0x7f0000000000))
194.769721ms ago: executing program 4 (id=319):
syz_open_dev$dmmidi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$dmmidi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$dmmidi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$dmmidi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$dmmidi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$dmmidi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$dmmidi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$dmmidi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$dmmidi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$dmmidi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$dmmidi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$dmmidi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$dmmidi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$dmmidi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$dmmidi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$dmmidi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$dmmidi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$dmmidi(&(0x7f0000000500), 0x4, 0x800)
192.934161ms ago: executing program 2 (id=320):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hpet', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hpet', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hpet', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hpet', 0x800, 0x0)
174.362364ms ago: executing program 3 (id=321):
symlink(&(0x7f0000000000), &(0x7f0000000000))
172.414636ms ago: executing program 5 (id=322):
llistxattr(&(0x7f0000000000), &(0x7f0000000000), 0x0)
167.363193ms ago: executing program 4 (id=323):
syz_open_dev$hiddev(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$hiddev(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$hiddev(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$hiddev(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$hiddev(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$hiddev(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$hiddev(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$hiddev(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$hiddev(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$hiddev(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$hiddev(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$hiddev(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$hiddev(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$hiddev(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$hiddev(&(0x7f0000000500), 0x4, 0x800)
119.7914ms ago: executing program 2 (id=324):
map_shadow_stack(0x0, 0x0, 0x0)
119.370689ms ago: executing program 0 (id=325):
clock_adjtime(0x0, &(0x7f0000000000))
119.198681ms ago: executing program 3 (id=326):
syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$vcsa(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$vcsa(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$vcsa(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$vcsa(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$vcsa(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$vcsa(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$vcsa(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$vcsa(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$vcsa(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$vcsa(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$vcsa(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$vcsa(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$vcsa(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$vcsa(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$vcsa(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$vcsa(&(0x7f0000000500), 0x4, 0x800)
119.00131ms ago: executing program 5 (id=327):
syz_open_dev$midi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$midi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$midi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$midi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$midi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$midi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$midi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$midi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$midi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$midi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$midi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$midi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$midi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$midi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$midi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$midi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$midi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$midi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$midi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$midi(&(0x7f0000000500), 0x4, 0x800)
118.826215ms ago: executing program 0 (id=328):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer', 0x800, 0x0)
118.597305ms ago: executing program 4 (id=329):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full', 0x800, 0x0)
112.281619ms ago: executing program 3 (id=330):
socket$nl_rdma(0x10, 0x3, 0x14)
107.722998ms ago: executing program 2 (id=331):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/tty', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tty', 0x800, 0x0)
107.386318ms ago: executing program 5 (id=332):
socket$inet6_mptcp(0xa, 0x1, 0x106)
55.495606ms ago: executing program 0 (id=333):
timer_delete(0x0)
55.285396ms ago: executing program 4 (id=334):
socket$inet6_dccp(0xa, 0x6, 0x0)
55.076373ms ago: executing program 5 (id=335):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs', 0x800, 0x0)
54.859806ms ago: executing program 3 (id=336):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dma_heap/system', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dma_heap/system', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dma_heap/system', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dma_heap/system', 0x800, 0x0)
54.73382ms ago: executing program 2 (id=337):
syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$loop(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$loop(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$loop(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$loop(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$loop(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$loop(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$loop(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$loop(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$loop(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$loop(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$loop(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$loop(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$loop(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$loop(&(0x7f0000000500), 0x4, 0x800)
54.627322ms ago: executing program 0 (id=338):
syz_open_dev$vcsu(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$vcsu(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$vcsu(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$vcsu(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$vcsu(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$vcsu(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$vcsu(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$vcsu(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$vcsu(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$vcsu(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$vcsu(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$vcsu(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$vcsu(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$vcsu(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$vcsu(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$vcsu(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$vcsu(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$vcsu(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$vcsu(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$vcsu(&(0x7f0000000500), 0x4, 0x800)
54.506505ms ago: executing program 5 (id=339):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vtpmx', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vtpmx', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vtpmx', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vtpmx', 0x800, 0x0)
54.144024ms ago: executing program 4 (id=340):
syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$video4linux(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$video4linux(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$video4linux(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$video4linux(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$video4linux(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$video4linux(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$video4linux(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$video4linux(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$video4linux(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$video4linux(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$video4linux(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$video4linux(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$video4linux(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$video4linux(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$video4linux(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$video4linux(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$video4linux(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$video4linux(&(0x7f0000000500), 0x4, 0x800)
607.29µs ago: executing program 0 (id=341):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/netlabel', 0x2, 0x0)
387.616µs ago: executing program 3 (id=342):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/acpi_thermal_rel', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/acpi_thermal_rel', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/acpi_thermal_rel', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/acpi_thermal_rel', 0x800, 0x0)
106.197µs ago: executing program 2 (id=343):
sync_file_range(0xffffffffffffffff, 0x0, 0x0, 0x0)
58.42µs ago: executing program 5 (id=344):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)
41.328µs ago: executing program 0 (id=345):
mq_unlink(&(0x7f0000000000))
0s ago: executing program 3 (id=346):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bifrost', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bifrost', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bifrost', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bifrost', 0x800, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.15.203' (ED25519) to the list of known hosts.
syzkaller login: [ 64.225389][ T5819] cgroup: Unknown subsys name 'net'
[ 64.333409][ T5819] cgroup: Unknown subsys name 'cpuset'
[ 64.342932][ T5819] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 65.724185][ T5819] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 68.302424][ T5902] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 68.780550][ T5964] mmap: syz.3.120 (5964) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[ 70.275050][ T6160] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 70.866581][ T1294] ieee802154 phy0 wpan0: encryption failed: -22
[ 70.878226][ T1294] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.111280][ T6205] ==================================================================
[ 71.119420][ T6205] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 71.127224][ T6205] Write of size 8 at addr ffff888144fba808 by task syz-executor/6205
[ 71.135316][ T6205]
[ 71.137652][ T6205] CPU: 1 UID: 0 PID: 6205 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 71.137680][ T6205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 71.137695][ T6205] Call Trace:
[ 71.137704][ T6205]
[ 71.137713][ T6205] dump_stack_lvl+0x241/0x360
[ 71.137745][ T6205] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.137770][ T6205] ? __pfx__printk+0x10/0x10
[ 71.137811][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.137852][ T6205] ? _printk+0xd5/0x120
[ 71.137889][ T6205] ? __virt_addr_valid+0x183/0x530
[ 71.137929][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.137970][ T6205] print_report+0x169/0x550
[ 71.138011][ T6205] ? __virt_addr_valid+0x183/0x530
[ 71.138049][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138087][ T6205] ? __virt_addr_valid+0x45f/0x530
[ 71.138123][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138159][ T6205] ? __phys_addr+0xba/0x170
[ 71.138197][ T6205] ? binder_add_device+0x5f/0xa0
[ 71.138228][ T6205] kasan_report+0x143/0x180
[ 71.138268][ T6205] ? binder_add_device+0x5f/0xa0
[ 71.138301][ T6205] binder_add_device+0x5f/0xa0
[ 71.138330][ T6205] binderfs_binder_device_create+0x7bf/0x9c0
[ 71.138366][ T6205] binderfs_fill_super+0x944/0xd90
[ 71.138399][ T6205] ? __pfx_binderfs_fill_super+0x10/0x10
[ 71.138441][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138490][ T6205] ? shrinker_register+0x160/0x230
[ 71.138524][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138559][ T6205] ? sget_fc+0x909/0x9c0
[ 71.138591][ T6205] ? __pfx_set_anon_super_fc+0x10/0x10
[ 71.138622][ T6205] ? __pfx_binderfs_fill_super+0x10/0x10
[ 71.138651][ T6205] get_tree_nodev+0xb9/0x140
[ 71.138686][ T6205] vfs_get_tree+0x92/0x2b0
[ 71.138724][ T6205] do_new_mount+0x2be/0xb40
[ 71.138750][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138791][ T6205] ? __pfx_do_new_mount+0x10/0x10
[ 71.138819][ T6205] __se_sys_mount+0x2d6/0x3c0
[ 71.138843][ T6205] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 71.138879][ T6205] ? __pfx___se_sys_mount+0x10/0x10
[ 71.138905][ T6205] ? do_syscall_64+0x100/0x230
[ 71.138945][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.138982][ T6205] ? __x64_sys_mount+0x20/0xc0
[ 71.139008][ T6205] do_syscall_64+0xf3/0x230
[ 71.139047][ T6205] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.139079][ T6205] RIP: 0033:0x7f43feb8e4ca
[ 71.139098][ T6205] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 71.139118][ T6205] RSP: 002b:00007f43feecff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 71.139144][ T6205] RAX: ffffffffffffffda RBX: 00007f43fec0e663 RCX: 00007f43feb8e4ca
[ 71.139161][ T6205] RDX: 00007f43fec1dd57 RSI: 00007f43fec0e663 RDI: 00007f43fec1dd57
[ 71.139179][ T6205] RBP: 00007f43fec0e85b R08: 0000000000000000 R09: 0000000000000100
[ 71.139195][ T6205] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f43febeb1c8
[ 71.139211][ T6205] R13: 00007f43febeb1a8 R14: 0000000000000009 R15: 0000000000000000
[ 71.139235][ T6205]
[ 71.139244][ T6205]
[ 71.441163][ T6205] Allocated by task 5836:
[ 71.445483][ T6205] kasan_save_track+0x3f/0x80
[ 71.450174][ T6205] __kasan_kmalloc+0x98/0xb0
[ 71.454766][ T6205] __kmalloc_cache_noprof+0x243/0x390
[ 71.460136][ T6205] binderfs_binder_device_create+0x16c/0x9c0
[ 71.466116][ T6205] binderfs_fill_super+0x944/0xd90
[ 71.471230][ T6205] get_tree_nodev+0xb9/0x140
[ 71.475822][ T6205] vfs_get_tree+0x92/0x2b0
[ 71.480243][ T6205] do_new_mount+0x2be/0xb40
[ 71.484741][ T6205] __se_sys_mount+0x2d6/0x3c0
[ 71.489422][ T6205] do_syscall_64+0xf3/0x230
[ 71.493930][ T6205] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.499828][ T6205]
[ 71.502141][ T6205] Freed by task 6197:
[ 71.506123][ T6205] kasan_save_track+0x3f/0x80
[ 71.510804][ T6205] kasan_save_free_info+0x40/0x50
[ 71.515824][ T6205] __kasan_slab_free+0x59/0x70
[ 71.520592][ T6205] kfree+0x196/0x430
[ 71.524480][ T6205] evict+0x4ea/0x9a0
[ 71.528381][ T6205] __dentry_kill+0x20d/0x630
[ 71.532967][ T6205] shrink_kill+0xa9/0x2c0
[ 71.537295][ T6205] shrink_dentry_list+0x2c0/0x5b0
[ 71.542315][ T6205] shrink_dcache_parent+0xcb/0x3b0
[ 71.547423][ T6205] do_one_tree+0x23/0xe0
[ 71.551660][ T6205] shrink_dcache_for_umount+0xb4/0x180
[ 71.557119][ T6205] generic_shutdown_super+0x6a/0x2d0
[ 71.562405][ T6205] kill_litter_super+0x76/0xb0
[ 71.567169][ T6205] binderfs_kill_super+0x44/0x90
[ 71.572104][ T6205] deactivate_locked_super+0xc6/0x130
[ 71.577477][ T6205] cleanup_mnt+0x41f/0x4b0
[ 71.581892][ T6205] task_work_run+0x251/0x310
[ 71.586489][ T6205] do_exit+0xa2a/0x28e0
[ 71.590649][ T6205] do_group_exit+0x207/0x2c0
[ 71.595241][ T6205] get_signal+0x16b2/0x1750
[ 71.599737][ T6205] arch_do_signal_or_restart+0x96/0x860
[ 71.605280][ T6205] irqentry_exit_to_user_mode+0x7e/0x250
[ 71.610917][ T6205] exc_page_fault+0x590/0x8b0
[ 71.615603][ T6205] asm_exc_page_fault+0x26/0x30
[ 71.620494][ T6205]
[ 71.622820][ T6205] The buggy address belongs to the object at ffff888144fba800
[ 71.622820][ T6205] which belongs to the cache kmalloc-512 of size 512
[ 71.636873][ T6205] The buggy address is located 8 bytes inside of
[ 71.636873][ T6205] freed 512-byte region [ffff888144fba800, ffff888144fbaa00)
[ 71.650501][ T6205]
[ 71.652814][ T6205] The buggy address belongs to the physical page:
[ 71.659209][ T6205] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144fb8
[ 71.668049][ T6205] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 71.676545][ T6205] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 71.684610][ T6205] page_type: f5(slab)
[ 71.688847][ T6205] raw: 057ff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 71.697425][ T6205] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 71.706004][ T6205] head: 057ff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 71.714672][ T6205] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 71.723343][ T6205] head: 057ff00000000002 ffffea000513ee01 ffffffffffffffff 0000000000000000
[ 71.732009][ T6205] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 71.740666][ T6205] page dumped because: kasan: bad access detected
[ 71.747064][ T6205] page_owner tracks the page as allocated
[ 71.752764][ T6205] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10642009827, free_ts 0
[ 71.770907][ T6205] post_alloc_hook+0x1f4/0x240
[ 71.775679][ T6205] get_page_from_freelist+0x365c/0x37a0
[ 71.781232][ T6205] __alloc_frozen_pages_noprof+0x292/0x710
[ 71.787047][ T6205] alloc_pages_mpol+0x311/0x660
[ 71.791890][ T6205] allocate_slab+0x8f/0x3a0
[ 71.796405][ T6205] ___slab_alloc+0xc27/0x14a0
[ 71.801081][ T6205] __slab_alloc+0x58/0xa0
[ 71.805409][ T6205] __kmalloc_cache_noprof+0x27b/0x390
[ 71.810778][ T6205] usb_cache_string+0x63/0x100
[ 71.815717][ T6205] usb_new_device+0x384/0x19a0
[ 71.820510][ T6205] register_root_hub+0x25c/0x550
[ 71.825443][ T6205] usb_add_hcd+0xb49/0x1110
[ 71.829943][ T6205] dummy_hcd_probe+0x158/0x2b0
[ 71.834705][ T6205] platform_probe+0x13c/0x1c0
[ 71.839375][ T6205] really_probe+0x2bb/0xad0
[ 71.843876][ T6205] __driver_probe_device+0x1a2/0x390
[ 71.849161][ T6205] page_owner free stack trace missing
[ 71.854512][ T6205]
[ 71.856823][ T6205] Memory state around the buggy address:
[ 71.862438][ T6205] ffff888144fba700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 71.870494][ T6205] ffff888144fba780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 71.878546][ T6205] >ffff888144fba800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.886592][ T6205] ^
[ 71.890906][ T6205] ffff888144fba880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.898954][ T6205] ffff888144fba900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.907001][ T6205] ==================================================================
[ 71.931253][ T6205] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.938473][ T6205] CPU: 1 UID: 0 PID: 6205 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 71.948993][ T6205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 71.959055][ T6205] Call Trace:
[ 71.962338][ T6205]
[ 71.965276][ T6205] dump_stack_lvl+0x241/0x360
[ 71.969974][ T6205] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.975190][ T6205] ? __pfx__printk+0x10/0x10
[ 71.979808][ T6205] ? preempt_schedule+0xe1/0xf0
[ 71.984684][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 71.990340][ T6205] ? vscnprintf+0x5d/0x90
[ 71.994701][ T6205] panic+0x349/0x880
[ 71.998625][ T6205] ? check_panic_on_warn+0x21/0xb0
[ 72.003761][ T6205] ? __pfx_panic+0x10/0x10
[ 72.008199][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.013893][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.019551][ T6205] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 72.025586][ T6205] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 72.031934][ T6205] ? print_report+0x502/0x550
[ 72.037076][ T6205] check_panic_on_warn+0x86/0xb0
[ 72.042040][ T6205] ? binder_add_device+0x5f/0xa0
[ 72.047001][ T6205] end_report+0x77/0x160
[ 72.051274][ T6205] kasan_report+0x154/0x180
[ 72.055891][ T6205] ? binder_add_device+0x5f/0xa0
[ 72.060939][ T6205] binder_add_device+0x5f/0xa0
[ 72.065722][ T6205] binderfs_binder_device_create+0x7bf/0x9c0
[ 72.071728][ T6205] binderfs_fill_super+0x944/0xd90
[ 72.076858][ T6205] ? __pfx_binderfs_fill_super+0x10/0x10
[ 72.082528][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.088190][ T6205] ? shrinker_register+0x160/0x230
[ 72.093325][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.099072][ T6205] ? sget_fc+0x909/0x9c0
[ 72.103338][ T6205] ? __pfx_set_anon_super_fc+0x10/0x10
[ 72.108817][ T6205] ? __pfx_binderfs_fill_super+0x10/0x10
[ 72.114470][ T6205] get_tree_nodev+0xb9/0x140
[ 72.119090][ T6205] vfs_get_tree+0x92/0x2b0
[ 72.123533][ T6205] do_new_mount+0x2be/0xb40
[ 72.128046][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.133707][ T6205] ? __pfx_do_new_mount+0x10/0x10
[ 72.138748][ T6205] __se_sys_mount+0x2d6/0x3c0
[ 72.143436][ T6205] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 72.149454][ T6205] ? __pfx___se_sys_mount+0x10/0x10
[ 72.154676][ T6205] ? do_syscall_64+0x100/0x230
[ 72.159465][ T6205] ? srso_alias_return_thunk+0x5/0xfbef5
[ 72.165130][ T6205] ? __x64_sys_mount+0x20/0xc0
[ 72.169908][ T6205] do_syscall_64+0xf3/0x230
[ 72.174442][ T6205] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.180372][ T6205] RIP: 0033:0x7f43feb8e4ca
[ 72.184800][ T6205] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 72.204425][ T6205] RSP: 002b:00007f43feecff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 72.212862][ T6205] RAX: ffffffffffffffda RBX: 00007f43fec0e663 RCX: 00007f43feb8e4ca
[ 72.220932][ T6205] RDX: 00007f43fec1dd57 RSI: 00007f43fec0e663 RDI: 00007f43fec1dd57
[ 72.228913][ T6205] RBP: 00007f43fec0e85b R08: 0000000000000000 R09: 0000000000000100
[ 72.236892][ T6205] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f43febeb1c8
[ 72.244873][ T6205] R13: 00007f43febeb1a8 R14: 0000000000000009 R15: 0000000000000000
[ 72.252863][ T6205]
[ 72.256114][ T6205] Kernel Offset: disabled
[ 72.260439][ T6205] Rebooting in 86400 seconds..