last executing test programs:
2.544604485s ago: executing program 4 (id=506):
setns(0xffffffffffffffff, 0x0)
2.483241329s ago: executing program 4 (id=509):
gettid()
2.46933863s ago: executing program 4 (id=513):
unshare(0x0)
2.399536591s ago: executing program 4 (id=515):
newfstatat(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000000), 0x0)
2.387485827s ago: executing program 4 (id=521):
rt_sigreturn()
1.703301872s ago: executing program 3 (id=581):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/lightnvm/control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/lightnvm/control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/lightnvm/control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/lightnvm/control', 0x800, 0x0)
1.703235469s ago: executing program 2 (id=582):
rt_sigaction(0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000))
1.703040491s ago: executing program 0 (id=583):
syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$I2C(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$I2C(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$I2C(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$I2C(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$I2C(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$I2C(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$I2C(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$I2C(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$I2C(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$I2C(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$I2C(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$I2C(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$I2C(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$I2C(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$I2C(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$I2C(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$I2C(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$I2C(&(0x7f0000000500), 0x4, 0x800)
1.702691651s ago: executing program 1 (id=585):
statx(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000))
1.695519776s ago: executing program 3 (id=586):
landlock_create_ruleset(&(0x7f0000000000), 0x0, 0x0)
1.685027226s ago: executing program 2 (id=587):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl', 0x800, 0x0)
1.636129296s ago: executing program 3 (id=589):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles', 0x800, 0x0)
1.636012487s ago: executing program 1 (id=590):
socket$inet6_mptcp(0xa, 0x1, 0x106)
1.635786087s ago: executing program 0 (id=591):
fchdir(0xffffffffffffffff)
1.635717154s ago: executing program 5 (id=592):
setresgid(0x0, 0x0, 0x0)
1.635656845s ago: executing program 0 (id=593):
finit_module(0xffffffffffffffff, &(0x7f0000000000), 0x0)
1.591560096s ago: executing program 2 (id=594):
shmat(0x0, 0x0, 0x0)
1.591386763s ago: executing program 1 (id=595):
syz_open_dev$admmidi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$admmidi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$admmidi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$admmidi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$admmidi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$admmidi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$admmidi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$admmidi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$admmidi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$admmidi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$admmidi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$admmidi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$admmidi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$admmidi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$admmidi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$admmidi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$admmidi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$admmidi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$admmidi(&(0x7f0000000500), 0x4, 0x800)
1.591277113s ago: executing program 2 (id=596):
process_mrelease(0xffffffffffffffff, 0x0)
1.591181155s ago: executing program 3 (id=597):
fchownat(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)
1.591075116s ago: executing program 5 (id=598):
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$hidraw(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$hidraw(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$hidraw(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$hidraw(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$hidraw(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$hidraw(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$hidraw(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$hidraw(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$hidraw(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$hidraw(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$hidraw(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$hidraw(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$hidraw(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$hidraw(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$hidraw(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$hidraw(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$hidraw(&(0x7f0000000500), 0x4, 0x800)
1.590969536s ago: executing program 0 (id=599):
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
1.579127712s ago: executing program 1 (id=600):
syz_open_dev$sndmidi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndmidi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndmidi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndmidi(&(0x7f0000000140), 0xa, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000180), 0xa, 0x1)
syz_open_dev$sndmidi(&(0x7f00000001c0), 0xa, 0x2)
syz_open_dev$sndmidi(&(0x7f0000000200), 0xa, 0x800)
syz_open_dev$sndmidi(&(0x7f0000000240), 0x14, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000280), 0x14, 0x1)
syz_open_dev$sndmidi(&(0x7f00000002c0), 0x14, 0x2)
syz_open_dev$sndmidi(&(0x7f0000000300), 0x14, 0x800)
syz_open_dev$sndmidi(&(0x7f0000000340), 0x1e, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000380), 0x1e, 0x1)
syz_open_dev$sndmidi(&(0x7f00000003c0), 0x1e, 0x2)
syz_open_dev$sndmidi(&(0x7f0000000400), 0x1e, 0x800)
syz_open_dev$sndmidi(&(0x7f0000000440), 0x28, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000480), 0x28, 0x1)
syz_open_dev$sndmidi(&(0x7f00000004c0), 0x28, 0x2)
syz_open_dev$sndmidi(&(0x7f0000000500), 0x28, 0x800)
1.572987235s ago: executing program 3 (id=601):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vndbinder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vndbinder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vndbinder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vndbinder', 0x800, 0x0)
1.530539551s ago: executing program 2 (id=602):
socket$can_j1939(0x1d, 0x2, 0x7)
1.530327746s ago: executing program 1 (id=603):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero', 0x800, 0x0)
1.530207529s ago: executing program 5 (id=604):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio', 0x800, 0x0)
1.530097585s ago: executing program 0 (id=605):
capget(&(0x7f0000000000), &(0x7f0000000000))
1.529801337s ago: executing program 2 (id=606):
socket$inet_udp(0x2, 0x2, 0x0)
1.455482509s ago: executing program 5 (id=608):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer', 0x800, 0x0)
1.414122269s ago: executing program 5 (id=612):
syz_open_dev$midi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$midi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$midi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$midi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$midi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$midi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$midi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$midi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$midi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$midi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$midi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$midi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$midi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$midi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$midi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$midi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$midi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$midi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$midi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$midi(&(0x7f0000000500), 0x4, 0x800)
593.245966ms ago: executing program 5 (id=613):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
561.649026ms ago: executing program 3 (id=607):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
557.628486ms ago: executing program 1 (id=609):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
136.576825ms ago: executing program 0 (id=610):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
0s ago: executing program 4 (id=618):
rmdir(&(0x7f0000000000))
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.160' (ED25519) to the list of known hosts.
[ 62.803298][ T5812] cgroup: Unknown subsys name 'net'
[ 62.933071][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 62.941251][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 64.353609][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 67.029445][ T5900] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 68.949973][ T6149] mmap: syz.5.306 (6149) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[ 69.862765][ T6267] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 70.854303][ T1287] ieee802154 phy0 wpan0: encryption failed: -22
[ 70.862780][ T1287] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.218683][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.229305][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.305618][ T3474] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.346927][ T3474] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.375055][ T6455] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 73.148297][ T6473] ==================================================================
[ 73.156400][ T6473] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 73.164150][ T6473] Write of size 8 at addr ffff8880331de008 by task syz-executor/6473
[ 73.172217][ T6473]
[ 73.174549][ T6473] CPU: 0 UID: 0 PID: 6473 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 73.174577][ T6473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 73.174591][ T6473] Call Trace:
[ 73.174600][ T6473]
[ 73.174610][ T6473] dump_stack_lvl+0x241/0x360
[ 73.174639][ T6473] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.174664][ T6473] ? __pfx__printk+0x10/0x10
[ 73.174705][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.174744][ T6473] ? _printk+0xd5/0x120
[ 73.174781][ T6473] ? __virt_addr_valid+0x183/0x530
[ 73.174820][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.174860][ T6473] print_report+0x169/0x550
[ 73.174900][ T6473] ? __virt_addr_valid+0x183/0x530
[ 73.174937][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.174974][ T6473] ? __virt_addr_valid+0x45f/0x530
[ 73.175011][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.175048][ T6473] ? __phys_addr+0xba/0x170
[ 73.175085][ T6473] ? binder_add_device+0x5f/0xa0
[ 73.175115][ T6473] kasan_report+0x143/0x180
[ 73.175154][ T6473] ? binder_add_device+0x5f/0xa0
[ 73.175189][ T6473] binder_add_device+0x5f/0xa0
[ 73.175220][ T6473] binderfs_binder_device_create+0x7bf/0x9c0
[ 73.175257][ T6473] binderfs_fill_super+0x944/0xd90
[ 73.175292][ T6473] ? __pfx_binderfs_fill_super+0x10/0x10
[ 73.175335][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.175373][ T6473] ? shrinker_register+0x160/0x230
[ 73.175406][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.175443][ T6473] ? sget_fc+0x909/0x9c0
[ 73.175475][ T6473] ? __pfx_set_anon_super_fc+0x10/0x10
[ 73.175508][ T6473] ? __pfx_binderfs_fill_super+0x10/0x10
[ 73.175545][ T6473] get_tree_nodev+0xb9/0x140
[ 73.175579][ T6473] vfs_get_tree+0x92/0x2b0
[ 73.175616][ T6473] do_new_mount+0x2be/0xb40
[ 73.175640][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.175680][ T6473] ? __pfx_do_new_mount+0x10/0x10
[ 73.175710][ T6473] __se_sys_mount+0x2d6/0x3c0
[ 73.175735][ T6473] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 73.175772][ T6473] ? __pfx___se_sys_mount+0x10/0x10
[ 73.175798][ T6473] ? do_syscall_64+0x100/0x230
[ 73.175837][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 73.175874][ T6473] ? __x64_sys_mount+0x20/0xc0
[ 73.175901][ T6473] do_syscall_64+0xf3/0x230
[ 73.175939][ T6473] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.175972][ T6473] RIP: 0033:0x7f2ebc18e54a
[ 73.175992][ T6473] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 73.176011][ T6473] RSP: 002b:00007ffe6e161858 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 73.176037][ T6473] RAX: ffffffffffffffda RBX: 00007f2ebc20e663 RCX: 00007f2ebc18e54a
[ 73.176055][ T6473] RDX: 00007f2ebc21dda7 RSI: 00007f2ebc20e663 RDI: 00007f2ebc21dda7
[ 73.176073][ T6473] RBP: 00007f2ebc20e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 73.176089][ T6473] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2ebc1eb1a8
[ 73.176105][ T6473] R13: 00007f2ebc1eb180 R14: 0000000000000009 R15: 0000000000000000
[ 73.176129][ T6473]
[ 73.176138][ T6473]
[ 73.477761][ T6473] Allocated by task 6458:
[ 73.482078][ T6473] kasan_save_track+0x3f/0x80
[ 73.486761][ T6473] __kasan_kmalloc+0x98/0xb0
[ 73.491357][ T6473] __kmalloc_cache_noprof+0x243/0x390
[ 73.496724][ T6473] binderfs_binder_device_create+0x16c/0x9c0
[ 73.502704][ T6473] binderfs_fill_super+0x944/0xd90
[ 73.507809][ T6473] get_tree_nodev+0xb9/0x140
[ 73.512400][ T6473] vfs_get_tree+0x92/0x2b0
[ 73.516816][ T6473] do_new_mount+0x2be/0xb40
[ 73.521312][ T6473] __se_sys_mount+0x2d6/0x3c0
[ 73.525981][ T6473] do_syscall_64+0xf3/0x230
[ 73.530487][ T6473] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.536385][ T6473]
[ 73.538697][ T6473] Freed by task 6458:
[ 73.542665][ T6473] kasan_save_track+0x3f/0x80
[ 73.547342][ T6473] kasan_save_free_info+0x40/0x50
[ 73.552361][ T6473] __kasan_slab_free+0x59/0x70
[ 73.557129][ T6473] kfree+0x196/0x430
[ 73.561018][ T6473] evict+0x4ea/0x9a0
[ 73.564914][ T6473] __dentry_kill+0x20d/0x630
[ 73.569499][ T6473] shrink_kill+0xa9/0x2c0
[ 73.573828][ T6473] shrink_dentry_list+0x2c0/0x5b0
[ 73.578866][ T6473] shrink_dcache_parent+0xcb/0x3b0
[ 73.583998][ T6473] do_one_tree+0x23/0xe0
[ 73.588243][ T6473] shrink_dcache_for_umount+0xb4/0x180
[ 73.593699][ T6473] generic_shutdown_super+0x6a/0x2d0
[ 73.598982][ T6473] kill_litter_super+0x76/0xb0
[ 73.603746][ T6473] binderfs_kill_super+0x44/0x90
[ 73.608681][ T6473] deactivate_locked_super+0xc6/0x130
[ 73.614050][ T6473] cleanup_mnt+0x41f/0x4b0
[ 73.618465][ T6473] task_work_run+0x251/0x310
[ 73.623061][ T6473] do_exit+0xa2a/0x28e0
[ 73.627216][ T6473] do_group_exit+0x207/0x2c0
[ 73.631809][ T6473] get_signal+0x16b2/0x1750
[ 73.636303][ T6473] arch_do_signal_or_restart+0x96/0x860
[ 73.641846][ T6473] syscall_exit_to_user_mode+0xce/0x340
[ 73.647395][ T6473] do_syscall_64+0x100/0x230
[ 73.651993][ T6473] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.657888][ T6473]
[ 73.660204][ T6473] The buggy address belongs to the object at ffff8880331de000
[ 73.660204][ T6473] which belongs to the cache kmalloc-512 of size 512
[ 73.674247][ T6473] The buggy address is located 8 bytes inside of
[ 73.674247][ T6473] freed 512-byte region [ffff8880331de000, ffff8880331de200)
[ 73.687860][ T6473]
[ 73.690174][ T6473] The buggy address belongs to the physical page:
[ 73.696571][ T6473] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x331dc
[ 73.705320][ T6473] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 73.713811][ T6473] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 73.721346][ T6473] page_type: f5(slab)
[ 73.725319][ T6473] raw: 00fff00000000040 ffff88801ac41c80 dead000000000122 0000000000000000
[ 73.733896][ T6473] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 73.742473][ T6473] head: 00fff00000000040 ffff88801ac41c80 dead000000000122 0000000000000000
[ 73.751135][ T6473] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 73.759802][ T6473] head: 00fff00000000002 ffffea0000cc7701 ffffffffffffffff 0000000000000000
[ 73.768464][ T6473] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 73.777130][ T6473] page dumped because: kasan: bad access detected
[ 73.783536][ T6473] page_owner tracks the page as allocated
[ 73.789234][ T6473] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3474, tgid 3474 (kworker/u8:6), ts 72400648720, free_ts 72395231324
[ 73.810592][ T6473] post_alloc_hook+0x1f4/0x240
[ 73.815384][ T6473] get_page_from_freelist+0x365c/0x37a0
[ 73.820935][ T6473] __alloc_frozen_pages_noprof+0x292/0x710
[ 73.826746][ T6473] alloc_pages_mpol+0x311/0x660
[ 73.831593][ T6473] allocate_slab+0x8f/0x3a0
[ 73.836097][ T6473] ___slab_alloc+0xc27/0x14a0
[ 73.840770][ T6473] __slab_alloc+0x58/0xa0
[ 73.845100][ T6473] __kmalloc_noprof+0x2e6/0x4c0
[ 73.849944][ T6473] fib6_info_alloc+0x2e/0xf0
[ 73.854527][ T6473] ip6_route_info_create+0x445/0x12b0
[ 73.859899][ T6473] ip6_route_add+0x28/0x160
[ 73.864400][ T6473] addrconf_add_dev+0x35b/0x540
[ 73.869248][ T6473] addrconf_init_auto_addrs+0x85f/0xeb0
[ 73.874799][ T6473] addrconf_notify+0xaff/0x1020
[ 73.879649][ T6473] notifier_call_chain+0x1a7/0x3f0
[ 73.884765][ T6473] netdev_state_change+0x11f/0x1a0
[ 73.889887][ T6473] page last free pid 3517 tgid 3517 stack trace:
[ 73.896197][ T6473] free_frozen_pages+0xe0d/0x10e0
[ 73.901221][ T6473] __folio_put+0x2b3/0x360
[ 73.905636][ T6473] free_large_kmalloc+0xfe/0x180
[ 73.910571][ T6473] kfree+0x212/0x430
[ 73.914457][ T6473] ops_free_list+0x2c3/0x370
[ 73.919053][ T6473] cleanup_net+0x912/0xd60
[ 73.923475][ T6473] process_scheduled_works+0xa68/0x1840
[ 73.929019][ T6473] worker_thread+0x870/0xd30
[ 73.933609][ T6473] kthread+0x7ab/0x920
[ 73.937681][ T6473] ret_from_fork+0x4d/0x80
[ 73.942097][ T6473] ret_from_fork_asm+0x1a/0x30
[ 73.946945][ T6473]
[ 73.949257][ T6473] Memory state around the buggy address:
[ 73.954876][ T6473] ffff8880331ddf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.962933][ T6473] ffff8880331ddf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.970989][ T6473] >ffff8880331de000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.979037][ T6473] ^
[ 73.983349][ T6473] ffff8880331de080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.991399][ T6473] ffff8880331de100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.999446][ T6473] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 74.293540][ T6473] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 74.300765][ T6473] CPU: 1 UID: 0 PID: 6473 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 74.311269][ T6473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 74.321329][ T6473] Call Trace:
[ 74.324606][ T6473]
[ 74.327538][ T6473] dump_stack_lvl+0x241/0x360
[ 74.332229][ T6473] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.337432][ T6473] ? __pfx__printk+0x10/0x10
[ 74.342045][ T6473] ? preempt_schedule+0xe1/0xf0
[ 74.346914][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.352574][ T6473] ? vscnprintf+0x5d/0x90
[ 74.356915][ T6473] panic+0x349/0x880
[ 74.360829][ T6473] ? check_panic_on_warn+0x21/0xb0
[ 74.365954][ T6473] ? __pfx_panic+0x10/0x10
[ 74.370382][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.376026][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.381665][ T6473] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 74.387647][ T6473] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 74.393975][ T6473] ? print_report+0x502/0x550
[ 74.398660][ T6473] check_panic_on_warn+0x86/0xb0
[ 74.403604][ T6473] ? binder_add_device+0x5f/0xa0
[ 74.408547][ T6473] end_report+0x77/0x160
[ 74.412794][ T6473] kasan_report+0x154/0x180
[ 74.417302][ T6473] ? binder_add_device+0x5f/0xa0
[ 74.422242][ T6473] binder_add_device+0x5f/0xa0
[ 74.427004][ T6473] binderfs_binder_device_create+0x7bf/0x9c0
[ 74.432987][ T6473] binderfs_fill_super+0x944/0xd90
[ 74.438100][ T6473] ? __pfx_binderfs_fill_super+0x10/0x10
[ 74.443742][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.449378][ T6473] ? shrinker_register+0x160/0x230
[ 74.454489][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.460131][ T6473] ? sget_fc+0x909/0x9c0
[ 74.464373][ T6473] ? __pfx_set_anon_super_fc+0x10/0x10
[ 74.469832][ T6473] ? __pfx_binderfs_fill_super+0x10/0x10
[ 74.475461][ T6473] get_tree_nodev+0xb9/0x140
[ 74.480059][ T6473] vfs_get_tree+0x92/0x2b0
[ 74.484484][ T6473] do_new_mount+0x2be/0xb40
[ 74.488978][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.494619][ T6473] ? __pfx_do_new_mount+0x10/0x10
[ 74.499640][ T6473] __se_sys_mount+0x2d6/0x3c0
[ 74.504315][ T6473] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 74.510298][ T6473] ? __pfx___se_sys_mount+0x10/0x10
[ 74.515489][ T6473] ? do_syscall_64+0x100/0x230
[ 74.520261][ T6473] ? srso_alias_return_thunk+0x5/0xfbef5
[ 74.525896][ T6473] ? __x64_sys_mount+0x20/0xc0
[ 74.530656][ T6473] do_syscall_64+0xf3/0x230
[ 74.535165][ T6473] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.541059][ T6473] RIP: 0033:0x7f2ebc18e54a
[ 74.545465][ T6473] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 74.565062][ T6473] RSP: 002b:00007ffe6e161858 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 74.573474][ T6473] RAX: ffffffffffffffda RBX: 00007f2ebc20e663 RCX: 00007f2ebc18e54a
[ 74.581438][ T6473] RDX: 00007f2ebc21dda7 RSI: 00007f2ebc20e663 RDI: 00007f2ebc21dda7
[ 74.589400][ T6473] RBP: 00007f2ebc20e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 74.597361][ T6473] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2ebc1eb1a8
[ 74.605324][ T6473] R13: 00007f2ebc1eb180 R14: 0000000000000009 R15: 0000000000000000
[ 74.613295][ T6473]
[ 74.616566][ T6473] Kernel Offset: disabled
[ 74.620880][ T6473] Rebooting in 86400 seconds..