last executing test programs:
270.957992ms ago: executing program 3 (id=85):
socket$rxrpc(0x21, 0x2, 0x0)
214.079102ms ago: executing program 3 (id=90):
epoll_create(0x0)
213.172835ms ago: executing program 3 (id=91):
socket$inet_udplite(0x2, 0x2, 0x88)
155.947035ms ago: executing program 0 (id=98):
socket$can_j1939(0x1d, 0x2, 0x7)
155.886368ms ago: executing program 3 (id=99):
socket$inet_dccp(0x2, 0x6, 0x0)
155.263125ms ago: executing program 0 (id=102):
epoll_pwait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0)
155.06073ms ago: executing program 4 (id=103):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0)
109.47084ms ago: executing program 1 (id=104):
socket$tipc(0x1e, 0x2, 0x0)
109.016331ms ago: executing program 2 (id=105):
unshare(0x0)
108.060765ms ago: executing program 3 (id=106):
socket$packet(0x11, 0x2, 0x300)
107.371813ms ago: executing program 4 (id=107):
socket$nl_xfrm(0x10, 0x3, 0x6)
105.441522ms ago: executing program 1 (id=108):
socket$alg(0x26, 0x5, 0x0)
104.757751ms ago: executing program 2 (id=109):
socket$nl_route(0x10, 0x3, 0x0)
104.679249ms ago: executing program 1 (id=110):
socket$can_raw(0x1d, 0x3, 0x1)
103.08867ms ago: executing program 0 (id=111):
pwritev(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)
63.833777ms ago: executing program 2 (id=112):
pread64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
63.502154ms ago: executing program 3 (id=113):
syz_init_net_socket$bt_cmtp(0x1f, 0x3, 0x5)
63.267315ms ago: executing program 4 (id=114):
socket$pppoe(0x18, 0x1, 0x0)
63.130433ms ago: executing program 1 (id=115):
syz_init_net_socket$netrom(0x6, 0x5, 0x0)
62.392643ms ago: executing program 0 (id=116):
epoll_create1(0x0)
62.210464ms ago: executing program 4 (id=117):
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
61.778464ms ago: executing program 0 (id=118):
socket$nl_rdma(0x10, 0x3, 0x14)
61.37068ms ago: executing program 2 (id=119):
socket$inet6_mptcp(0xa, 0x1, 0x106)
1.077632ms ago: executing program 1 (id=120):
socket$can_bcm(0x1d, 0x2, 0x2)
897.657µs ago: executing program 4 (id=121):
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
846.815µs ago: executing program 2 (id=122):
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
730.031µs ago: executing program 0 (id=123):
socket$key(0xf, 0x3, 0x2)
516.541µs ago: executing program 4 (id=124):
vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
152.773µs ago: executing program 1 (id=125):
syz_init_net_socket$x25(0x9, 0x5, 0x0)
0s ago: executing program 2 (id=126):
socket$l2tp(0x2, 0x2, 0x73)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.42' (ED25519) to the list of known hosts.
[ 54.723468][ T5818] cgroup: Unknown subsys name 'net'
[ 54.850329][ T5818] cgroup: Unknown subsys name 'cpuset'
[ 54.858324][ T5818] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 56.143714][ T5818] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 58.460926][ T5908] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 58.594308][ T5930] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 59.265029][ T5973] ==================================================================
[ 59.273140][ T5973] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 59.280894][ T5973] Write of size 8 at addr ffff88814d967c08 by task syz-executor/5973
[ 59.288980][ T5973]
[ 59.291336][ T5973] CPU: 0 UID: 0 PID: 5973 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01200-g9e3285040514 #0
[ 59.291371][ T5973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 59.291386][ T5973] Call Trace:
[ 59.291392][ T5973]
[ 59.291404][ T5973] dump_stack_lvl+0x241/0x360
[ 59.291427][ T5973] ? __pfx_dump_stack_lvl+0x10/0x10
[ 59.291444][ T5973] ? __pfx__printk+0x10/0x10
[ 59.291460][ T5973] ? _printk+0xd5/0x120
[ 59.291474][ T5973] ? __virt_addr_valid+0x183/0x530
[ 59.291489][ T5973] ? __virt_addr_valid+0x183/0x530
[ 59.291504][ T5973] print_report+0x16e/0x5b0
[ 59.291523][ T5973] ? __virt_addr_valid+0x183/0x530
[ 59.291537][ T5973] ? __virt_addr_valid+0x183/0x530
[ 59.291551][ T5973] ? __virt_addr_valid+0x45f/0x530
[ 59.291564][ T5973] ? __phys_addr+0xba/0x170
[ 59.291578][ T5973] ? binder_add_device+0x5f/0xa0
[ 59.291597][ T5973] kasan_report+0x143/0x180
[ 59.291616][ T5973] ? binder_add_device+0x5f/0xa0
[ 59.291636][ T5973] binder_add_device+0x5f/0xa0
[ 59.291654][ T5973] binderfs_binder_device_create+0x878/0xab0
[ 59.291677][ T5973] binderfs_fill_super+0x96e/0xe70
[ 59.291697][ T5973] ? __pfx_binderfs_fill_super+0x10/0x10
[ 59.291723][ T5973] ? shrinker_register+0x160/0x230
[ 59.291746][ T5973] ? sget_fc+0x960/0xa50
[ 59.291762][ T5973] ? __pfx_set_anon_super_fc+0x10/0x10
[ 59.291778][ T5973] ? __pfx_binderfs_fill_super+0x10/0x10
[ 59.291796][ T5973] get_tree_nodev+0xb7/0x140
[ 59.291813][ T5973] vfs_get_tree+0x90/0x2b0
[ 59.291830][ T5973] do_new_mount+0x2be/0xb40
[ 59.291852][ T5973] ? __pfx_do_new_mount+0x10/0x10
[ 59.291874][ T5973] __se_sys_mount+0x2d6/0x3c0
[ 59.291894][ T5973] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 59.291916][ T5973] ? __pfx___se_sys_mount+0x10/0x10
[ 59.291936][ T5973] ? do_syscall_64+0x100/0x230
[ 59.291956][ T5973] ? __x64_sys_mount+0x20/0xc0
[ 59.291976][ T5973] do_syscall_64+0xf3/0x230
[ 59.291994][ T5973] ? clear_bhb_loop+0x35/0x90
[ 59.292015][ T5973] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 59.292038][ T5973] RIP: 0033:0x7f117738e90a
[ 59.292056][ T5973] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 59.292069][ T5973] RSP: 002b:00007ffec1948398 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 59.292086][ T5973] RAX: ffffffffffffffda RBX: 00007f117740e663 RCX: 00007f117738e90a
[ 59.292098][ T5973] RDX: 00007f117741dda7 RSI: 00007f117740e663 RDI: 00007f117741dda7
[ 59.292108][ T5973] RBP: 00007f117740e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 59.292118][ T5973] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f11773eb1a8
[ 59.292128][ T5973] R13: 00007f11773eb180 R14: 0000000000000009 R15: 0000000000000000
[ 59.292143][ T5973]
[ 59.292152][ T5973]
[ 59.565049][ T5973] Allocated by task 5832:
[ 59.569370][ T5973] kasan_save_track+0x3f/0x80
[ 59.574049][ T5973] __kasan_kmalloc+0x98/0xb0
[ 59.578636][ T5973] __kmalloc_cache_noprof+0x243/0x390
[ 59.583998][ T5973] binderfs_binder_device_create+0x171/0xab0
[ 59.589965][ T5973] binderfs_fill_super+0x96e/0xe70
[ 59.595062][ T5973] get_tree_nodev+0xb7/0x140
[ 59.599641][ T5973] vfs_get_tree+0x90/0x2b0
[ 59.604055][ T5973] do_new_mount+0x2be/0xb40
[ 59.608543][ T5973] __se_sys_mount+0x2d6/0x3c0
[ 59.613207][ T5973] do_syscall_64+0xf3/0x230
[ 59.617706][ T5973] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 59.623605][ T5973]
[ 59.625920][ T5973] Freed by task 5832:
[ 59.629994][ T5973] kasan_save_track+0x3f/0x80
[ 59.634671][ T5973] kasan_save_free_info+0x40/0x50
[ 59.639685][ T5973] __kasan_slab_free+0x59/0x70
[ 59.644435][ T5973] kfree+0x196/0x430
[ 59.648315][ T5973] evict+0x4e8/0x9a0
[ 59.652280][ T5973] __dentry_kill+0x20d/0x630
[ 59.656866][ T5973] shrink_kill+0xa9/0x2c0
[ 59.661190][ T5973] shrink_dentry_list+0x2c0/0x5b0
[ 59.666202][ T5973] shrink_dcache_parent+0xcb/0x3b0
[ 59.671371][ T5973] do_one_tree+0x23/0xe0
[ 59.675615][ T5973] shrink_dcache_for_umount+0xb4/0x180
[ 59.681074][ T5973] generic_shutdown_super+0x6a/0x2d0
[ 59.686351][ T5973] kill_litter_super+0x76/0xb0
[ 59.691107][ T5973] binderfs_kill_super+0x44/0x90
[ 59.696031][ T5973] deactivate_locked_super+0xc4/0x130
[ 59.701397][ T5973] cleanup_mnt+0x41f/0x4b0
[ 59.705809][ T5973] task_work_run+0x24f/0x310
[ 59.710389][ T5973] do_exit+0xa2a/0x28e0
[ 59.714533][ T5973] do_group_exit+0x207/0x2c0
[ 59.719125][ T5973] get_signal+0x168c/0x1720
[ 59.723636][ T5973] arch_do_signal_or_restart+0x96/0x860
[ 59.729181][ T5973] syscall_exit_to_user_mode+0xce/0x340
[ 59.734733][ T5973] do_syscall_64+0x100/0x230
[ 59.739321][ T5973] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 59.745218][ T5973]
[ 59.747535][ T5973] The buggy address belongs to the object at ffff88814d967c00
[ 59.747535][ T5973] which belongs to the cache kmalloc-512 of size 512
[ 59.761574][ T5973] The buggy address is located 8 bytes inside of
[ 59.761574][ T5973] freed 512-byte region [ffff88814d967c00, ffff88814d967e00)
[ 59.775211][ T5973]
[ 59.777539][ T5973] The buggy address belongs to the physical page:
[ 59.783957][ T5973] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d964
[ 59.792817][ T5973] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 59.801320][ T5973] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 59.808939][ T5973] page_type: f5(slab)
[ 59.812906][ T5973] raw: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 59.821565][ T5973] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 59.830135][ T5973] head: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 59.838787][ T5973] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 59.847442][ T5973] head: 057ff00000000002 ffffea0005365901 ffffffffffffffff 0000000000000000
[ 59.856102][ T5973] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 59.864755][ T5973] page dumped because: kasan: bad access detected
[ 59.871161][ T5973] page_owner tracks the page as allocated
[ 59.876857][ T5973] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14053787518, free_ts 0
[ 59.896642][ T5973] post_alloc_hook+0x1f4/0x240
[ 59.901399][ T5973] get_page_from_freelist+0x365c/0x37a0
[ 59.907015][ T5973] __alloc_frozen_pages_noprof+0x292/0x710
[ 59.912821][ T5973] alloc_pages_mpol+0x311/0x660
[ 59.917660][ T5973] allocate_slab+0x8f/0x3a0
[ 59.922147][ T5973] ___slab_alloc+0xc27/0x14a0
[ 59.926810][ T5973] __slab_alloc+0x58/0xa0
[ 59.931132][ T5973] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0
[ 59.937533][ T5973] krealloc_noprof+0x10f/0x300
[ 59.942281][ T5973] add_sysfs_param+0xca/0x820
[ 59.946944][ T5973] kernel_add_sysfs_param+0xb4/0x130
[ 59.952213][ T5973] param_sysfs_builtin+0x1d7/0x290
[ 59.957311][ T5973] param_sysfs_builtin_init+0x31/0x40
[ 59.962670][ T5973] do_one_initcall+0x248/0x930
[ 59.967419][ T5973] do_initcall_level+0x157/0x210
[ 59.972362][ T5973] do_initcalls+0x71/0xd0
[ 59.976678][ T5973] page_owner free stack trace missing
[ 59.982048][ T5973]
[ 59.984357][ T5973] Memory state around the buggy address:
[ 59.989968][ T5973] ffff88814d967b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 59.998020][ T5973] ffff88814d967b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 60.006070][ T5973] >ffff88814d967c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.014110][ T5973] ^
[ 60.018449][ T5973] ffff88814d967c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.026489][ T5973] ffff88814d967d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.034529][ T5973] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 60.138768][ T5973] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 60.146051][ T5973] CPU: 1 UID: 0 PID: 5973 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01200-g9e3285040514 #0
[ 60.156910][ T5973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 60.166978][ T5973] Call Trace:
[ 60.170277][ T5973]
[ 60.173219][ T5973] dump_stack_lvl+0x241/0x360
[ 60.177916][ T5973] ? __pfx_dump_stack_lvl+0x10/0x10
[ 60.183109][ T5973] ? __pfx__printk+0x10/0x10
[ 60.187687][ T5973] ? preempt_schedule+0xe1/0xf0
[ 60.192527][ T5973] ? vscnprintf+0x5d/0x90
[ 60.196842][ T5973] panic+0x349/0x880
[ 60.200732][ T5973] ? check_panic_on_warn+0x21/0xb0
[ 60.205863][ T5973] ? __pfx_panic+0x10/0x10
[ 60.210273][ T5973] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 60.216242][ T5973] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 60.222571][ T5973] ? print_report+0x519/0x5b0
[ 60.227240][ T5973] check_panic_on_warn+0x86/0xb0
[ 60.232175][ T5973] ? binder_add_device+0x5f/0xa0
[ 60.237106][ T5973] end_report+0x77/0x160
[ 60.241338][ T5973] kasan_report+0x154/0x180
[ 60.245868][ T5973] ? binder_add_device+0x5f/0xa0
[ 60.250798][ T5973] binder_add_device+0x5f/0xa0
[ 60.255573][ T5973] binderfs_binder_device_create+0x878/0xab0
[ 60.261544][ T5973] binderfs_fill_super+0x96e/0xe70
[ 60.266648][ T5973] ? __pfx_binderfs_fill_super+0x10/0x10
[ 60.272278][ T5973] ? shrinker_register+0x160/0x230
[ 60.277396][ T5973] ? sget_fc+0x960/0xa50
[ 60.281626][ T5973] ? __pfx_set_anon_super_fc+0x10/0x10
[ 60.287072][ T5973] ? __pfx_binderfs_fill_super+0x10/0x10
[ 60.292691][ T5973] get_tree_nodev+0xb7/0x140
[ 60.297272][ T5973] vfs_get_tree+0x90/0x2b0
[ 60.301678][ T5973] do_new_mount+0x2be/0xb40
[ 60.306172][ T5973] ? __pfx_do_new_mount+0x10/0x10
[ 60.311204][ T5973] __se_sys_mount+0x2d6/0x3c0
[ 60.315882][ T5973] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 60.321852][ T5973] ? __pfx___se_sys_mount+0x10/0x10
[ 60.327036][ T5973] ? do_syscall_64+0x100/0x230
[ 60.331788][ T5973] ? __x64_sys_mount+0x20/0xc0
[ 60.336622][ T5973] do_syscall_64+0xf3/0x230
[ 60.341113][ T5973] ? clear_bhb_loop+0x35/0x90
[ 60.345778][ T5973] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 60.351659][ T5973] RIP: 0033:0x7f117738e90a
[ 60.356146][ T5973] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 60.375828][ T5973] RSP: 002b:00007ffec1948398 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 60.384234][ T5973] RAX: ffffffffffffffda RBX: 00007f117740e663 RCX: 00007f117738e90a
[ 60.392287][ T5973] RDX: 00007f117741dda7 RSI: 00007f117740e663 RDI: 00007f117741dda7
[ 60.400251][ T5973] RBP: 00007f117740e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 60.408209][ T5973] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f11773eb1a8
[ 60.416186][ T5973] R13: 00007f11773eb180 R14: 0000000000000009 R15: 0000000000000000
[ 60.424149][ T5973]
[ 60.427401][ T5973] Kernel Offset: disabled
[ 60.431708][ T5973] Rebooting in 86400 seconds..