last executing test programs:
678.902234ms ago: executing program 2 (id=127):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/change-rule', 0x2, 0x0)
606.717675ms ago: executing program 2 (id=132):
epoll_pwait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0)
579.245146ms ago: executing program 2 (id=138):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/seq', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/seq', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snd/seq', 0x800, 0x0)
578.926952ms ago: executing program 4 (id=139):
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$sndctrl(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$sndctrl(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$sndctrl(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$sndctrl(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000500), 0x4, 0x800)
507.502329ms ago: executing program 3 (id=142):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom', 0x800, 0x0)
507.279098ms ago: executing program 2 (id=143):
socket$can_bcm(0x1d, 0x2, 0x2)
494.972457ms ago: executing program 3 (id=146):
syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$media(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$media(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$media(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$media(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$media(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$media(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$media(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$media(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$media(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$media(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$media(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$media(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$media(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$media(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$media(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$media(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$media(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$media(&(0x7f0000000500), 0x4, 0x800)
494.759371ms ago: executing program 4 (id=147):
socket$nl_sock_diag(0x10, 0x3, 0x4)
479.443359ms ago: executing program 5 (id=148):
init_module(&(0x7f0000000000), 0x0, &(0x7f0000000000))
423.575104ms ago: executing program 4 (id=150):
syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndpcmp(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndpcmp(&(0x7f0000000140), 0xa, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000180), 0xa, 0x1)
syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xa, 0x2)
syz_open_dev$sndpcmp(&(0x7f0000000200), 0xa, 0x800)
syz_open_dev$sndpcmp(&(0x7f0000000240), 0x14, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000280), 0x14, 0x1)
syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x14, 0x2)
syz_open_dev$sndpcmp(&(0x7f0000000300), 0x14, 0x800)
syz_open_dev$sndpcmp(&(0x7f0000000340), 0x1e, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000380), 0x1e, 0x1)
syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x1e, 0x2)
syz_open_dev$sndpcmp(&(0x7f0000000400), 0x1e, 0x800)
syz_open_dev$sndpcmp(&(0x7f0000000440), 0x28, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000480), 0x28, 0x1)
syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x28, 0x2)
syz_open_dev$sndpcmp(&(0x7f0000000500), 0x28, 0x800)
423.353025ms ago: executing program 2 (id=151):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp1', 0x800, 0x0)
423.001932ms ago: executing program 3 (id=153):
syz_open_dev$admmidi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$admmidi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$admmidi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$admmidi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$admmidi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$admmidi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$admmidi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$admmidi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$admmidi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$admmidi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$admmidi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$admmidi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$admmidi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$admmidi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$admmidi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$admmidi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$admmidi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$admmidi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$admmidi(&(0x7f0000000500), 0x4, 0x800)
422.843354ms ago: executing program 5 (id=154):
iopl(0x0)
419.621589ms ago: executing program 0 (id=155):
acct(0x0)
411.015863ms ago: executing program 1 (id=156):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/pktcdvd/control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control', 0x800, 0x0)
347.446537ms ago: executing program 4 (id=157):
fchdir(0xffffffffffffffff)
347.241646ms ago: executing program 3 (id=158):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp0', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp0', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp0', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp0', 0x800, 0x0)
347.085904ms ago: executing program 5 (id=159):
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
346.999022ms ago: executing program 0 (id=160):
ioprio_set$auto(0x0, 0x0, 0x0)
346.924594ms ago: executing program 1 (id=161):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill', 0x800, 0x0)
337.005752ms ago: executing program 4 (id=162):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/unconfined', 0x2, 0x0)
320.72604ms ago: executing program 1 (id=163):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dma_heap/system', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dma_heap/system', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dma_heap/system', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dma_heap/system', 0x800, 0x0)
320.373443ms ago: executing program 3 (id=164):
getpid()
271.769661ms ago: executing program 0 (id=165):
syz_open_dev$sndhw(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndhw(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndhw(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndhw(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndhw(&(0x7f0000000140), 0xa, 0x0)
syz_open_dev$sndhw(&(0x7f0000000180), 0xa, 0x1)
syz_open_dev$sndhw(&(0x7f00000001c0), 0xa, 0x2)
syz_open_dev$sndhw(&(0x7f0000000200), 0xa, 0x800)
syz_open_dev$sndhw(&(0x7f0000000240), 0x14, 0x0)
syz_open_dev$sndhw(&(0x7f0000000280), 0x14, 0x1)
syz_open_dev$sndhw(&(0x7f00000002c0), 0x14, 0x2)
syz_open_dev$sndhw(&(0x7f0000000300), 0x14, 0x800)
syz_open_dev$sndhw(&(0x7f0000000340), 0x1e, 0x0)
syz_open_dev$sndhw(&(0x7f0000000380), 0x1e, 0x1)
syz_open_dev$sndhw(&(0x7f00000003c0), 0x1e, 0x2)
syz_open_dev$sndhw(&(0x7f0000000400), 0x1e, 0x800)
syz_open_dev$sndhw(&(0x7f0000000440), 0x28, 0x0)
syz_open_dev$sndhw(&(0x7f0000000480), 0x28, 0x1)
syz_open_dev$sndhw(&(0x7f00000004c0), 0x28, 0x2)
syz_open_dev$sndhw(&(0x7f0000000500), 0x28, 0x800)
271.690477ms ago: executing program 5 (id=166):
clock_gettime(0x0, &(0x7f0000000000))
271.577527ms ago: executing program 0 (id=167):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0', 0x800, 0x0)
271.507876ms ago: executing program 4 (id=168):
fanotify_init(0x0, 0x0)
271.292263ms ago: executing program 5 (id=169):
set_thread_area(&(0x7f0000000000))
256.271435ms ago: executing program 1 (id=170):
socket$inet6_dccp(0xa, 0x6, 0x0)
243.107958ms ago: executing program 0 (id=171):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwbinder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwbinder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwbinder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwbinder', 0x800, 0x0)
243.002324ms ago: executing program 3 (id=172):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem', 0x1, 0x0)
179.840261ms ago: executing program 5 (id=173):
lseek(0xffffffffffffffff, 0x0, 0x0)
179.728617ms ago: executing program 0 (id=174):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/btf/vmlinux', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/btf/vmlinux', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/btf/vmlinux', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/btf/vmlinux', 0x800, 0x0)
179.578158ms ago: executing program 1 (id=175):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0)
105.043135ms ago: executing program 1 (id=179):
socket$inet6_udplite(0xa, 0x2, 0x88)
0s ago: executing program 2 (id=181):
getgroups(0x0, &(0x7f0000000000))
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.185' (ED25519) to the list of known hosts.
[ 82.188779][ T5814] cgroup: Unknown subsys name 'net'
[ 82.320997][ T5814] cgroup: Unknown subsys name 'cpuset'
[ 82.330087][ T5814] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 83.870764][ T5814] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 87.773767][ T6019] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 88.289179][ T6017] ==================================================================
[ 88.297380][ T6017] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0
[ 88.305253][ T6017] Write of size 8 at addr ffff8880311b5408 by task syz-executor/6017
[ 88.313429][ T6017]
[ 88.315832][ T6017] CPU: 1 UID: 0 PID: 6017 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 88.315875][ T6017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 88.315896][ T6017] Call Trace:
[ 88.315908][ T6017]
[ 88.315920][ T6017] dump_stack_lvl+0x116/0x1f0
[ 88.315970][ T6017] print_report+0xc3/0x620
[ 88.316029][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.316089][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.316148][ T6017] ? __phys_addr+0xc6/0x150
[ 88.316187][ T6017] kasan_report+0xd9/0x110
[ 88.316241][ T6017] ? binder_add_device+0xa4/0xb0
[ 88.316284][ T6017] ? binder_add_device+0xa4/0xb0
[ 88.316330][ T6017] binder_add_device+0xa4/0xb0
[ 88.316372][ T6017] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 88.316432][ T6017] binderfs_fill_super+0x8d6/0x1360
[ 88.316487][ T6017] ? __pfx_binderfs_fill_super+0x10/0x10
[ 88.316539][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.316623][ T6017] ? shrinker_register+0x1a8/0x260
[ 88.316670][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.316729][ T6017] ? sget_fc+0x808/0xc20
[ 88.316776][ T6017] ? apparmor_capable+0x114/0x1d0
[ 88.316836][ T6017] ? __pfx_set_anon_super_fc+0x10/0x10
[ 88.316882][ T6017] ? __pfx_binderfs_fill_super+0x10/0x10
[ 88.316933][ T6017] get_tree_nodev+0xdd/0x190
[ 88.316983][ T6017] vfs_get_tree+0x8e/0x340
[ 88.317024][ T6017] path_mount+0x14e6/0x1f10
[ 88.317082][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.317141][ T6017] ? kmem_cache_free+0x2e2/0x4d0
[ 88.317194][ T6017] ? __pfx_path_mount+0x10/0x10
[ 88.317254][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 88.317312][ T6017] ? putname+0x13c/0x180
[ 88.317349][ T6017] __x64_sys_mount+0x28f/0x310
[ 88.317407][ T6017] ? __pfx___x64_sys_mount+0x10/0x10
[ 88.317471][ T6017] do_syscall_64+0xcd/0x250
[ 88.317519][ T6017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.317577][ T6017] RIP: 0033:0x7f239e38e4ca
[ 88.317604][ T6017] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 88.317639][ T6017] RSP: 002b:00007ffe4aa98418 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 88.317672][ T6017] RAX: ffffffffffffffda RBX: 00007f239e40e663 RCX: 00007f239e38e4ca
[ 88.317697][ T6017] RDX: 00007f239e41dd57 RSI: 00007f239e40e663 RDI: 00007f239e41dd57
[ 88.317721][ T6017] RBP: 00007f239e40e85b R08: 0000000000000000 R09: 00000000000001ff
[ 88.317744][ T6017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f239e3eb1c8
[ 88.317765][ T6017] R13: 00007f239e3eb1a8 R14: 0000000000000009 R15: 0000000000000000
[ 88.317798][ T6017]
[ 88.317810][ T6017]
[ 88.580871][ T6017] Allocated by task 5827:
[ 88.585212][ T6017] kasan_save_stack+0x33/0x60
[ 88.589942][ T6017] kasan_save_track+0x14/0x30
[ 88.594696][ T6017] __kasan_kmalloc+0xaa/0xb0
[ 88.599514][ T6017] binderfs_binder_device_create.isra.0+0x17a/0xb70
[ 88.606181][ T6017] binderfs_fill_super+0x8d6/0x1360
[ 88.611508][ T6017] get_tree_nodev+0xdd/0x190
[ 88.616136][ T6017] vfs_get_tree+0x8e/0x340
[ 88.620578][ T6017] path_mount+0x14e6/0x1f10
[ 88.625289][ T6017] __x64_sys_mount+0x28f/0x310
[ 88.630151][ T6017] do_syscall_64+0xcd/0x250
[ 88.634766][ T6017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.640723][ T6017]
[ 88.643193][ T6017] Freed by task 5827:
[ 88.647186][ T6017] kasan_save_stack+0x33/0x60
[ 88.651914][ T6017] kasan_save_track+0x14/0x30
[ 88.656820][ T6017] kasan_save_free_info+0x3b/0x60
[ 88.662014][ T6017] __kasan_slab_free+0x51/0x70
[ 88.666930][ T6017] kfree+0x2c4/0x4d0
[ 88.670998][ T6017] binderfs_evict_inode+0x1e0/0x250
[ 88.676325][ T6017] evict+0x40c/0x960
[ 88.680254][ T6017] iput+0x52a/0x890
[ 88.684092][ T6017] dentry_unlink_inode+0x29c/0x480
[ 88.689324][ T6017] __dentry_kill+0x1d0/0x600
[ 88.693952][ T6017] shrink_dentry_list+0x140/0x5d0
[ 88.699010][ T6017] shrink_dcache_parent+0xe2/0x530
[ 88.704203][ T6017] shrink_dcache_for_umount+0xa1/0x3e0
[ 88.709702][ T6017] generic_shutdown_super+0x6c/0x390
[ 88.715053][ T6017] kill_litter_super+0x70/0xa0
[ 88.719963][ T6017] binderfs_kill_super+0x3b/0xa0
[ 88.724945][ T6017] deactivate_locked_super+0xc1/0x1a0
[ 88.730363][ T6017] deactivate_super+0xde/0x100
[ 88.735167][ T6017] cleanup_mnt+0x222/0x450
[ 88.739625][ T6017] task_work_run+0x151/0x250
[ 88.744364][ T6017] do_exit+0xad8/0x2d70
[ 88.748598][ T6017] do_group_exit+0xd3/0x2a0
[ 88.753282][ T6017] get_signal+0x24ed/0x26c0
[ 88.758002][ T6017] arch_do_signal_or_restart+0x90/0x7e0
[ 88.763599][ T6017] syscall_exit_to_user_mode+0x150/0x2a0
[ 88.769332][ T6017] do_syscall_64+0xda/0x250
[ 88.773906][ T6017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.779970][ T6017]
[ 88.782328][ T6017] The buggy address belongs to the object at ffff8880311b5400
[ 88.782328][ T6017] which belongs to the cache kmalloc-512 of size 512
[ 88.796591][ T6017] The buggy address is located 8 bytes inside of
[ 88.796591][ T6017] freed 512-byte region [ffff8880311b5400, ffff8880311b5600)
[ 88.810336][ T6017]
[ 88.812763][ T6017] The buggy address belongs to the physical page:
[ 88.819228][ T6017] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x311b4
[ 88.828013][ T6017] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 88.836746][ T6017] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 88.844314][ T6017] page_type: f5(slab)
[ 88.848438][ T6017] raw: 00fff00000000040 ffff88801b041c80 ffffea0000a82b00 dead000000000002
[ 88.857174][ T6017] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 88.865901][ T6017] head: 00fff00000000040 ffff88801b041c80 ffffea0000a82b00 dead000000000002
[ 88.874616][ T6017] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 88.883582][ T6017] head: 00fff00000000002 ffffea0000c46d01 ffffffffffffffff 0000000000000000
[ 88.892381][ T6017] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 88.901176][ T6017] page dumped because: kasan: bad access detected
[ 88.907766][ T6017] page_owner tracks the page as allocated
[ 88.913529][ T6017] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5212, tgid 5212 (udevadm), ts 40785196966, free_ts 40772311816
[ 88.934532][ T6017] post_alloc_hook+0x181/0x1b0
[ 88.939351][ T6017] get_page_from_freelist+0xfce/0x2f80
[ 88.945032][ T6017] __alloc_frozen_pages_noprof+0x221/0x2470
[ 88.951045][ T6017] alloc_pages_mpol+0x1fc/0x540
[ 88.956040][ T6017] new_slab+0x23d/0x330
[ 88.960261][ T6017] ___slab_alloc+0xc5d/0x1720
[ 88.965014][ T6017] __slab_alloc.constprop.0+0x56/0xb0
[ 88.970448][ T6017] __kmalloc_cache_noprof+0xfa/0x410
[ 88.975788][ T6017] kernfs_fop_open+0x28b/0xdb0
[ 88.980606][ T6017] do_dentry_open+0x738/0x1c40
[ 88.985442][ T6017] vfs_open+0x82/0x3f0
[ 88.989546][ T6017] path_openat+0x1e88/0x2d80
[ 88.994338][ T6017] do_filp_open+0x20c/0x470
[ 88.998899][ T6017] do_sys_openat2+0x17a/0x1e0
[ 89.003639][ T6017] __x64_sys_openat+0x175/0x210
[ 89.008598][ T6017] do_syscall_64+0xcd/0x250
[ 89.013143][ T6017] page last free pid 5200 tgid 5200 stack trace:
[ 89.019746][ T6017] free_frozen_pages+0x6db/0xfb0
[ 89.024767][ T6017] qlist_free_all+0x4e/0x120
[ 89.029441][ T6017] kasan_quarantine_reduce+0x195/0x1e0
[ 89.035062][ T6017] __kasan_slab_alloc+0x69/0x90
[ 89.040068][ T6017] kmem_cache_alloc_noprof+0x226/0x3d0
[ 89.045668][ T6017] getname_flags.part.0+0x4c/0x550
[ 89.051117][ T6017] getname+0x8d/0xe0
[ 89.055201][ T6017] vfs_fstatat+0xdf/0xf0
[ 89.059520][ T6017] __do_sys_newfstatat+0x98/0x120
[ 89.064624][ T6017] do_syscall_64+0xcd/0x250
[ 89.069299][ T6017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.075234][ T6017]
[ 89.077632][ T6017] Memory state around the buggy address:
[ 89.083293][ T6017] ffff8880311b5300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 89.091476][ T6017] ffff8880311b5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 89.099590][ T6017] >ffff8880311b5400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.107965][ T6017] ^
[ 89.112447][ T6017] ffff8880311b5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.120662][ T6017] ffff8880311b5500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.128742][ T6017] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 89.209519][ T6017] Kernel panic - not syncing: kasan.fault=panic_on_write set ...
[ 89.217371][ T6017] CPU: 0 UID: 0 PID: 6017 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[ 89.227947][ T6017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 89.238192][ T6017] Call Trace:
[ 89.241528][ T6017]
[ 89.244551][ T6017] dump_stack_lvl+0x3d/0x1f0
[ 89.249303][ T6017] panic+0x71d/0x800
[ 89.253253][ T6017] ? __pfx_panic+0x10/0x10
[ 89.257719][ T6017] ? lockdep_hardirqs_on+0x7c/0x110
[ 89.262975][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.268692][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.274405][ T6017] ? preempt_schedule_common+0x44/0xc0
[ 89.279968][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.285684][ T6017] ? preempt_schedule_thunk+0x1a/0x30
[ 89.291128][ T6017] end_report+0x169/0x180
[ 89.295560][ T6017] kasan_report+0xe9/0x110
[ 89.300061][ T6017] ? binder_add_device+0xa4/0xb0
[ 89.305084][ T6017] ? binder_add_device+0xa4/0xb0
[ 89.310095][ T6017] binder_add_device+0xa4/0xb0
[ 89.314924][ T6017] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 89.321602][ T6017] binderfs_fill_super+0x8d6/0x1360
[ 89.326887][ T6017] ? __pfx_binderfs_fill_super+0x10/0x10
[ 89.332739][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.338461][ T6017] ? shrinker_register+0x1a8/0x260
[ 89.343673][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.349430][ T6017] ? sget_fc+0x808/0xc20
[ 89.353868][ T6017] ? apparmor_capable+0x114/0x1d0
[ 89.359109][ T6017] ? __pfx_set_anon_super_fc+0x10/0x10
[ 89.364717][ T6017] ? __pfx_binderfs_fill_super+0x10/0x10
[ 89.370541][ T6017] get_tree_nodev+0xdd/0x190
[ 89.375256][ T6017] vfs_get_tree+0x8e/0x340
[ 89.379916][ T6017] path_mount+0x14e6/0x1f10
[ 89.384588][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.390382][ T6017] ? kmem_cache_free+0x2e2/0x4d0
[ 89.395391][ T6017] ? __pfx_path_mount+0x10/0x10
[ 89.400373][ T6017] ? srso_alias_return_thunk+0x5/0xfbef5
[ 89.406085][ T6017] ? putname+0x13c/0x180
[ 89.410429][ T6017] __x64_sys_mount+0x28f/0x310
[ 89.415325][ T6017] ? __pfx___x64_sys_mount+0x10/0x10
[ 89.420698][ T6017] do_syscall_64+0xcd/0x250
[ 89.425273][ T6017] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.431277][ T6017] RIP: 0033:0x7f239e38e4ca
[ 89.435752][ T6017] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 89.455667][ T6017] RSP: 002b:00007ffe4aa98418 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 89.464146][ T6017] RAX: ffffffffffffffda RBX: 00007f239e40e663 RCX: 00007f239e38e4ca
[ 89.472257][ T6017] RDX: 00007f239e41dd57 RSI: 00007f239e40e663 RDI: 00007f239e41dd57
[ 89.480370][ T6017] RBP: 00007f239e40e85b R08: 0000000000000000 R09: 00000000000001ff
[ 89.488463][ T6017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f239e3eb1c8
[ 89.496573][ T6017] R13: 00007f239e3eb1a8 R14: 0000000000000009 R15: 0000000000000000
[ 89.504740][ T6017]
[ 89.508234][ T6017] Kernel Offset: disabled
[ 89.512574][ T6017] Rebooting in 86400 seconds..