last executing test programs:

307.292261ms ago: executing program 1 (id=2):
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0)

283.90098ms ago: executing program 1 (id=6):
perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0)

260.906814ms ago: executing program 1 (id=7):
write(0xffffffffffffffff, &(0x7f0000000000), 0x0)

209.133389ms ago: executing program 1 (id=8):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0)

208.968988ms ago: executing program 1 (id=9):
close(0xffffffffffffffff)

202.651206ms ago: executing program 2 (id=3):
sendmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

198.212456ms ago: executing program 0 (id=1):
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000))

149.193045ms ago: executing program 1 (id=10):
mkdir(&(0x7f0000000000), 0x0)

52.769028ms ago: executing program 3 (id=4):
recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

0s ago: executing program 4 (id=5):
socket(0x1e, 0x2, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.10.17' (ED25519) to the list of known hosts.
[   61.128244][ T5821] cgroup: Unknown subsys name 'net'
[   61.260639][ T5821] cgroup: Unknown subsys name 'cpuset'
[   61.268543][ T5821] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   62.656525][ T5821] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.880441][ T5851] ==================================================================
[   64.888609][ T5851] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[   64.896381][ T5851] Write of size 8 at addr ffff888143399008 by task syz-executor/5851
[   64.904549][ T5851] 
[   64.906937][ T5851] CPU: 0 UID: 0 PID: 5851 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-ga74a2a3e639f #0
[   64.906956][ T5851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   64.906973][ T5851] Call Trace:
[   64.906983][ T5851]  <TASK>
[   64.906990][ T5851]  dump_stack_lvl+0x241/0x360
[   64.907013][ T5851]  ? __pfx_dump_stack_lvl+0x10/0x10
[   64.907030][ T5851]  ? __pfx__printk+0x10/0x10
[   64.907046][ T5851]  ? _printk+0xd5/0x120
[   64.907060][ T5851]  ? __virt_addr_valid+0x183/0x530
[   64.907075][ T5851]  ? __virt_addr_valid+0x183/0x530
[   64.907090][ T5851]  print_report+0x16e/0x5b0
[   64.907110][ T5851]  ? __virt_addr_valid+0x183/0x530
[   64.907124][ T5851]  ? __virt_addr_valid+0x183/0x530
[   64.907137][ T5851]  ? __virt_addr_valid+0x45f/0x530
[   64.907151][ T5851]  ? __phys_addr+0xba/0x170
[   64.907173][ T5851]  ? binder_add_device+0x5f/0xa0
[   64.907192][ T5851]  kasan_report+0x143/0x180
[   64.907213][ T5851]  ? binder_add_device+0x5f/0xa0
[   64.907233][ T5851]  binder_add_device+0x5f/0xa0
[   64.907251][ T5851]  binderfs_binder_device_create+0x878/0xab0
[   64.907278][ T5851]  binderfs_fill_super+0x96e/0xe70
[   64.907295][ T5851]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.907317][ T5851]  ? shrinker_register+0x160/0x230
[   64.907332][ T5851]  ? sget_fc+0x960/0xa50
[   64.907346][ T5851]  ? __pfx_set_anon_super_fc+0x10/0x10
[   64.907360][ T5851]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.907376][ T5851]  get_tree_nodev+0xb7/0x140
[   64.907391][ T5851]  vfs_get_tree+0x90/0x2b0
[   64.907411][ T5851]  do_new_mount+0x2be/0xb40
[   64.907433][ T5851]  ? __pfx_do_new_mount+0x10/0x10
[   64.907457][ T5851]  __se_sys_mount+0x2d6/0x3c0
[   64.907477][ T5851]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   64.907499][ T5851]  ? __pfx___se_sys_mount+0x10/0x10
[   64.907520][ T5851]  ? do_syscall_64+0x100/0x230
[   64.907536][ T5851]  ? __x64_sys_mount+0x20/0xc0
[   64.907557][ T5851]  do_syscall_64+0xf3/0x230
[   64.907572][ T5851]  ? clear_bhb_loop+0x35/0x90
[   64.907594][ T5851]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.907613][ T5851] RIP: 0033:0x7f3a0138e90a
[   64.907634][ T5851] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   64.907648][ T5851] RSP: 002b:00007ffe44ad3778 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   64.907665][ T5851] RAX: ffffffffffffffda RBX: 00007f3a0140e663 RCX: 00007f3a0138e90a
[   64.907677][ T5851] RDX: 00007f3a0141dda7 RSI: 00007f3a0140e663 RDI: 00007f3a0141dda7
[   64.907689][ T5851] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   64.907699][ T5851] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a01428480
[   64.907709][ T5851] R13: 00007ffe44ad37f8 R14: 0000000000000009 R15: 0000000000000000
[   64.907726][ T5851]  </TASK>
[   64.907732][ T5851] 
[   65.179600][ T5851] Allocated by task 5835:
[   65.183999][ T5851]  kasan_save_track+0x3f/0x80
[   65.188671][ T5851]  __kasan_kmalloc+0x98/0xb0
[   65.193335][ T5851]  __kmalloc_cache_noprof+0x243/0x390
[   65.198696][ T5851]  binderfs_binder_device_create+0x171/0xab0
[   65.204748][ T5851]  binderfs_fill_super+0x96e/0xe70
[   65.209840][ T5851]  get_tree_nodev+0xb7/0x140
[   65.214415][ T5851]  vfs_get_tree+0x90/0x2b0
[   65.218815][ T5851]  do_new_mount+0x2be/0xb40
[   65.223304][ T5851]  __se_sys_mount+0x2d6/0x3c0
[   65.227970][ T5851]  do_syscall_64+0xf3/0x230
[   65.232463][ T5851]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.238352][ T5851] 
[   65.240662][ T5851] Freed by task 5835:
[   65.244624][ T5851]  kasan_save_track+0x3f/0x80
[   65.249302][ T5851]  kasan_save_free_info+0x40/0x50
[   65.254309][ T5851]  __kasan_slab_free+0x59/0x70
[   65.259057][ T5851]  kfree+0x196/0x430
[   65.262942][ T5851]  evict+0x4e8/0x9a0
[   65.266847][ T5851]  __dentry_kill+0x20d/0x630
[   65.271427][ T5851]  shrink_kill+0xa9/0x2c0
[   65.275737][ T5851]  shrink_dentry_list+0x2c0/0x5b0
[   65.280742][ T5851]  shrink_dcache_parent+0xcb/0x3b0
[   65.285837][ T5851]  do_one_tree+0x23/0xe0
[   65.290067][ T5851]  shrink_dcache_for_umount+0xb4/0x180
[   65.295509][ T5851]  generic_shutdown_super+0x6a/0x2d0
[   65.300779][ T5851]  kill_litter_super+0x76/0xb0
[   65.305525][ T5851]  binderfs_kill_super+0x44/0x90
[   65.310446][ T5851]  deactivate_locked_super+0xc4/0x130
[   65.315800][ T5851]  cleanup_mnt+0x41f/0x4b0
[   65.320216][ T5851]  task_work_run+0x24f/0x310
[   65.324788][ T5851]  do_exit+0xa2a/0x28e0
[   65.329026][ T5851]  do_group_exit+0x207/0x2c0
[   65.333602][ T5851]  get_signal+0x168c/0x1720
[   65.338087][ T5851]  arch_do_signal_or_restart+0x96/0x860
[   65.343617][ T5851]  syscall_exit_to_user_mode+0xce/0x340
[   65.349154][ T5851]  do_syscall_64+0x100/0x230
[   65.353729][ T5851]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.359614][ T5851] 
[   65.361919][ T5851] The buggy address belongs to the object at ffff888143399000
[   65.361919][ T5851]  which belongs to the cache kmalloc-512 of size 512
[   65.376038][ T5851] The buggy address is located 8 bytes inside of
[   65.376038][ T5851]  freed 512-byte region [ffff888143399000, ffff888143399200)
[   65.389641][ T5851] 
[   65.391950][ T5851] The buggy address belongs to the physical page:
[   65.398343][ T5851] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x143398
[   65.407199][ T5851] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   65.415681][ T5851] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   65.423293][ T5851] page_type: f5(slab)
[   65.427258][ T5851] raw: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[   65.435826][ T5851] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.444407][ T5851] head: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[   65.453074][ T5851] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.461727][ T5851] head: 057ff00000000002 ffffea00050ce601 ffffffffffffffff 0000000000000000
[   65.470381][ T5851] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   65.479036][ T5851] page dumped because: kasan: bad access detected
[   65.485442][ T5851] page_owner tracks the page as allocated
[   65.491141][ T5851] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7077438227, free_ts 0
[   65.509201][ T5851]  post_alloc_hook+0x1f4/0x240
[   65.513955][ T5851]  get_page_from_freelist+0x3a8c/0x3c20
[   65.519576][ T5851]  __alloc_frozen_pages_noprof+0x264/0x580
[   65.525370][ T5851]  alloc_pages_mpol+0x311/0x660
[   65.530211][ T5851]  allocate_slab+0x8f/0x3a0
[   65.534699][ T5851]  ___slab_alloc+0xc27/0x14a0
[   65.539363][ T5851]  __slab_alloc+0x58/0xa0
[   65.543701][ T5851]  __kmalloc_cache_node_noprof+0x294/0x3a0
[   65.549515][ T5851]  dd_init_sched+0x8c/0x580
[   65.554010][ T5851]  blk_mq_init_sched+0x3c4/0x830
[   65.558955][ T5851]  elevator_init_mq+0x1b7/0x310
[   65.563795][ T5851]  add_disk_fwnode+0x1a8/0xfc0
[   65.568544][ T5851]  nbd_dev_add+0x812/0xc60
[   65.572948][ T5851]  nbd_init+0x210/0x2c0
[   65.577090][ T5851]  do_one_initcall+0x248/0x930
[   65.581851][ T5851]  do_initcall_level+0x157/0x210
[   65.586781][ T5851] page_owner free stack trace missing
[   65.592222][ T5851] 
[   65.594534][ T5851] Memory state around the buggy address:
[   65.600151][ T5851]  ffff888143398f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.608201][ T5851]  ffff888143398f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.616246][ T5851] >ffff888143399000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.624288][ T5851]                       ^
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   65.628597][ T5851]  ffff888143399080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.636641][ T5851]  ffff888143399100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.644856][ T5851] ==================================================================
[   65.703927][ T5852] syz-executor: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   65.724558][ T5851] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.731784][ T5851] CPU: 0 UID: 0 PID: 5851 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-ga74a2a3e639f #0
[   65.742132][ T5851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   65.752210][ T5851] Call Trace:
[   65.755516][ T5851]  <TASK>
[   65.758470][ T5851]  dump_stack_lvl+0x241/0x360
[   65.763172][ T5851]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.768395][ T5851]  ? __pfx__printk+0x10/0x10
[   65.773014][ T5851]  ? preempt_schedule+0xe1/0xf0
[   65.777919][ T5851]  ? vscnprintf+0x5d/0x90
[   65.782297][ T5851]  panic+0x349/0x880
[   65.786184][ T5851]  ? check_panic_on_warn+0x21/0xb0
[   65.791295][ T5851]  ? __pfx_panic+0x10/0x10
[   65.795715][ T5851]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   65.801689][ T5851]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   65.808006][ T5851]  ? print_report+0x519/0x5b0
[   65.812675][ T5851]  check_panic_on_warn+0x86/0xb0
[   65.817704][ T5851]  ? binder_add_device+0x5f/0xa0
[   65.822631][ T5851]  end_report+0x77/0x160
[   65.826864][ T5851]  kasan_report+0x154/0x180
[   65.831382][ T5851]  ? binder_add_device+0x5f/0xa0
[   65.836310][ T5851]  binder_add_device+0x5f/0xa0
[   65.841210][ T5851]  binderfs_binder_device_create+0x878/0xab0
[   65.847209][ T5851]  binderfs_fill_super+0x96e/0xe70
[   65.852322][ T5851]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.857975][ T5851]  ? shrinker_register+0x160/0x230
[   65.863077][ T5851]  ? sget_fc+0x960/0xa50
[   65.867313][ T5851]  ? __pfx_set_anon_super_fc+0x10/0x10
[   65.872764][ T5851]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.878382][ T5851]  get_tree_nodev+0xb7/0x140
[   65.883048][ T5851]  vfs_get_tree+0x90/0x2b0
[   65.887455][ T5851]  do_new_mount+0x2be/0xb40
[   65.892009][ T5851]  ? __pfx_do_new_mount+0x10/0x10
[   65.897028][ T5851]  __se_sys_mount+0x2d6/0x3c0
[   65.901693][ T5851]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   65.907666][ T5851]  ? __pfx___se_sys_mount+0x10/0x10
[   65.912858][ T5851]  ? do_syscall_64+0x100/0x230
[   65.917611][ T5851]  ? __x64_sys_mount+0x20/0xc0
[   65.922367][ T5851]  do_syscall_64+0xf3/0x230
[   65.926856][ T5851]  ? clear_bhb_loop+0x35/0x90
[   65.931523][ T5851]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.937410][ T5851] RIP: 0033:0x7f3a0138e90a
[   65.941811][ T5851] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.961406][ T5851] RSP: 002b:00007ffe44ad3778 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   65.969822][ T5851] RAX: ffffffffffffffda RBX: 00007f3a0140e663 RCX: 00007f3a0138e90a
[   65.977795][ T5851] RDX: 00007f3a0141dda7 RSI: 00007f3a0140e663 RDI: 00007f3a0141dda7
[   65.985763][ T5851] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   65.993718][ T5851] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a01428480
[   66.001676][ T5851] R13: 00007ffe44ad37f8 R14: 0000000000000009 R15: 0000000000000000
[   66.009641][ T5851]  </TASK>
[   66.012943][ T5851] Kernel Offset: disabled
[   66.017263][ T5851] Rebooting in 86400 seconds..