last executing test programs:
734.010131ms ago: executing program 3 (id=4):
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0)
714.209414ms ago: executing program 3 (id=6):
syz_open_dev$radio(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$radio(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$radio(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$radio(&(0x7f0000000100), 0x0, 0x800)
701.52111ms ago: executing program 3 (id=7):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/syslog', 0x2, 0x0)
643.49867ms ago: executing program 3 (id=8):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot', 0x800, 0x0)
641.068247ms ago: executing program 0 (id=1):
socket$isdn_base(0x22, 0x3, 0x0)
599.915643ms ago: executing program 0 (id=9):
socket$nl_audit(0x10, 0x3, 0x9)
555.211913ms ago: executing program 1 (id=2):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock', 0x800, 0x0)
533.534554ms ago: executing program 0 (id=12):
pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
532.794719ms ago: executing program 1 (id=13):
pidfd_open(0x0, 0x0)
532.480655ms ago: executing program 4 (id=5):
epoll_pwait2(0xffffffffffffffff, &(0x7f0000000000), 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0)
501.138675ms ago: executing program 0 (id=15):
socket$l2tp(0x2, 0x2, 0x73)
451.504585ms ago: executing program 1 (id=16):
sched_setscheduler(0x0, 0x0, &(0x7f0000000000))
451.345367ms ago: executing program 4 (id=17):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf', 0x2, 0x0)
271.497552ms ago: executing program 2 (id=24):
socket$isdn(0x22, 0x3, 0x0)
271.412412ms ago: executing program 2 (id=25):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0', 0x2, 0x0)
271.292975ms ago: executing program 2 (id=26):
exit_group(0x0)
258.64012ms ago: executing program 2 (id=27):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsu', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsu', 0x800, 0x0)
234.063541ms ago: executing program 2 (id=28):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwbinder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwbinder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwbinder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwbinder', 0x800, 0x0)
155.402219ms ago: executing program 2 (id=29):
syz_open_dev$admmidi(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$admmidi(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$admmidi(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$admmidi(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$admmidi(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$admmidi(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$admmidi(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$admmidi(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$admmidi(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$admmidi(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$admmidi(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$admmidi(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$admmidi(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$admmidi(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$admmidi(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$admmidi(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$admmidi(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$admmidi(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$admmidi(&(0x7f0000000500), 0x4, 0x800)
0s ago: executing program 4 (id=19):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.123' (ED25519) to the list of known hosts.
syzkaller login: [ 62.052380][ T5808] cgroup: Unknown subsys name 'net'
[ 62.158381][ T5808] cgroup: Unknown subsys name 'cpuset'
[ 62.166327][ T5808] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 63.459912][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 65.970691][ T5848] ==================================================================
[ 65.978800][ T5848] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 65.986569][ T5848] Write of size 8 at addr ffff8880335be408 by task syz-executor/5848
[ 65.994740][ T5848]
[ 65.997098][ T5848] CPU: 1 UID: 0 PID: 5848 Comm: syz-executor Not tainted 6.13.0-syzkaller-09338-g05dbaf8dd8bf #0
[ 65.997119][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 65.997134][ T5848] Call Trace:
[ 65.997140][ T5848]
[ 65.997147][ T5848] dump_stack_lvl+0x241/0x360
[ 65.997168][ T5848] ? __pfx_dump_stack_lvl+0x10/0x10
[ 65.997183][ T5848] ? __pfx__printk+0x10/0x10
[ 65.997205][ T5848] ? _printk+0xd5/0x120
[ 65.997224][ T5848] ? __virt_addr_valid+0x183/0x530
[ 65.997245][ T5848] ? __virt_addr_valid+0x183/0x530
[ 65.997265][ T5848] print_report+0x169/0x550
[ 65.997283][ T5848] ? __virt_addr_valid+0x183/0x530
[ 65.997302][ T5848] ? __virt_addr_valid+0x183/0x530
[ 65.997321][ T5848] ? __virt_addr_valid+0x45f/0x530
[ 65.997339][ T5848] ? __phys_addr+0xba/0x170
[ 65.997358][ T5848] ? binder_add_device+0x5f/0xa0
[ 65.997375][ T5848] kasan_report+0x143/0x180
[ 65.997393][ T5848] ? binder_add_device+0x5f/0xa0
[ 65.997413][ T5848] binder_add_device+0x5f/0xa0
[ 65.997431][ T5848] binderfs_binder_device_create+0x7bf/0x9c0
[ 65.997452][ T5848] binderfs_fill_super+0x944/0xd90
[ 65.997472][ T5848] ? __pfx_binderfs_fill_super+0x10/0x10
[ 65.997498][ T5848] ? shrinker_register+0x160/0x230
[ 65.997521][ T5848] ? sget_fc+0x909/0x9c0
[ 65.997543][ T5848] ? __pfx_set_anon_super_fc+0x10/0x10
[ 65.997557][ T5848] ? __pfx_binderfs_fill_super+0x10/0x10
[ 65.997574][ T5848] get_tree_nodev+0xb7/0x140
[ 65.997588][ T5848] vfs_get_tree+0x90/0x2b0
[ 65.997604][ T5848] do_new_mount+0x2be/0xb40
[ 65.997623][ T5848] ? __pfx_do_new_mount+0x10/0x10
[ 65.997642][ T5848] __se_sys_mount+0x2d6/0x3c0
[ 65.997660][ T5848] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 65.997679][ T5848] ? __pfx___se_sys_mount+0x10/0x10
[ 65.997696][ T5848] ? do_syscall_64+0x100/0x230
[ 65.997717][ T5848] ? __x64_sys_mount+0x20/0xc0
[ 65.997734][ T5848] do_syscall_64+0xf3/0x230
[ 65.997752][ T5848] ? clear_bhb_loop+0x35/0x90
[ 65.997773][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 65.997791][ T5848] RIP: 0033:0x7f982138e54a
[ 65.997812][ T5848] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 65.997824][ T5848] RSP: 002b:00007ffc4996f9a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 65.997841][ T5848] RAX: ffffffffffffffda RBX: 00007f982140e663 RCX: 00007f982138e54a
[ 65.997852][ T5848] RDX: 00007f982141dda7 RSI: 00007f982140e663 RDI: 00007f982141dda7
[ 65.997863][ T5848] RBP: 00007f982140e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 65.997873][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f98213eb1a8
[ 65.997882][ T5848] R13: 00007f98213eb180 R14: 0000000000000009 R15: 0000000000000000
[ 65.997912][ T5848]
[ 65.997918][ T5848]
[ 66.272134][ T5848] Allocated by task 5822:
[ 66.276457][ T5848] kasan_save_track+0x3f/0x80
[ 66.281134][ T5848] __kasan_kmalloc+0x98/0xb0
[ 66.285716][ T5848] __kmalloc_cache_noprof+0x243/0x390
[ 66.291077][ T5848] binderfs_binder_device_create+0x16c/0x9c0
[ 66.297107][ T5848] binderfs_fill_super+0x944/0xd90
[ 66.302222][ T5848] get_tree_nodev+0xb7/0x140
[ 66.306891][ T5848] vfs_get_tree+0x90/0x2b0
[ 66.311295][ T5848] do_new_mount+0x2be/0xb40
[ 66.315789][ T5848] __se_sys_mount+0x2d6/0x3c0
[ 66.320455][ T5848] do_syscall_64+0xf3/0x230
[ 66.324967][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.331036][ T5848]
[ 66.333351][ T5848] Freed by task 5822:
[ 66.337319][ T5848] kasan_save_track+0x3f/0x80
[ 66.341990][ T5848] kasan_save_free_info+0x40/0x50
[ 66.347011][ T5848] __kasan_slab_free+0x59/0x70
[ 66.351767][ T5848] kfree+0x196/0x430
[ 66.355825][ T5848] evict+0x4e8/0x9a0
[ 66.359716][ T5848] __dentry_kill+0x20d/0x630
[ 66.364295][ T5848] shrink_kill+0xa9/0x2c0
[ 66.368627][ T5848] shrink_dentry_list+0x2c0/0x5b0
[ 66.373642][ T5848] shrink_dcache_parent+0xcb/0x3b0
[ 66.378773][ T5848] do_one_tree+0x23/0xe0
[ 66.383023][ T5848] shrink_dcache_for_umount+0xb4/0x180
[ 66.388572][ T5848] generic_shutdown_super+0x6a/0x2d0
[ 66.393990][ T5848] kill_litter_super+0x76/0xb0
[ 66.398763][ T5848] binderfs_kill_super+0x44/0x90
[ 66.403705][ T5848] deactivate_locked_super+0xc4/0x130
[ 66.409092][ T5848] cleanup_mnt+0x41f/0x4b0
[ 66.413608][ T5848] task_work_run+0x24f/0x310
[ 66.418222][ T5848] do_exit+0xa2a/0x28e0
[ 66.422374][ T5848] do_group_exit+0x207/0x2c0
[ 66.427322][ T5848] get_signal+0x16b2/0x1750
[ 66.431839][ T5848] arch_do_signal_or_restart+0x96/0x860
[ 66.437469][ T5848] syscall_exit_to_user_mode+0xce/0x340
[ 66.443013][ T5848] do_syscall_64+0x100/0x230
[ 66.447600][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.453560][ T5848]
[ 66.455879][ T5848] The buggy address belongs to the object at ffff8880335be400
[ 66.455879][ T5848] which belongs to the cache kmalloc-512 of size 512
[ 66.470016][ T5848] The buggy address is located 8 bytes inside of
[ 66.470016][ T5848] freed 512-byte region [ffff8880335be400, ffff8880335be600)
[ 66.483729][ T5848]
[ 66.486049][ T5848] The buggy address belongs to the physical page:
[ 66.492545][ T5848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x335bc
[ 66.501292][ T5848] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 66.509799][ T5848] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 66.517359][ T5848] page_type: f5(slab)
[ 66.521418][ T5848] raw: 00fff00000000040 ffff88801ac41c80 ffffea0000ab7200 dead000000000002
[ 66.530095][ T5848] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 66.538690][ T5848] head: 00fff00000000040 ffff88801ac41c80 ffffea0000ab7200 dead000000000002
[ 66.547625][ T5848] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 66.557002][ T5848] head: 00fff00000000002 ffffea0000cd6f01 ffffffffffffffff 0000000000000000
[ 66.565878][ T5848] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 66.574628][ T5848] page dumped because: kasan: bad access detected
[ 66.581036][ T5848] page_owner tracks the page as allocated
[ 66.586740][ T5848] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5210, tgid 5210 (udevadm), ts 24650581478, free_ts 24622982899
[ 66.607755][ T5848] post_alloc_hook+0x1f4/0x240
[ 66.612634][ T5848] get_page_from_freelist+0x3651/0x37a0
[ 66.618189][ T5848] __alloc_frozen_pages_noprof+0x292/0x710
[ 66.623986][ T5848] alloc_pages_mpol+0x311/0x660
[ 66.628829][ T5848] allocate_slab+0x8f/0x3a0
[ 66.633351][ T5848] ___slab_alloc+0xc27/0x14a0
[ 66.638047][ T5848] __slab_alloc+0x58/0xa0
[ 66.642369][ T5848] __kmalloc_cache_noprof+0x27b/0x390
[ 66.647836][ T5848] kernfs_fop_open+0x3e0/0xd10
[ 66.652682][ T5848] do_dentry_open+0xdec/0x1960
[ 66.657870][ T5848] vfs_open+0x3b/0x370
[ 66.661931][ T5848] path_openat+0x2c74/0x3580
[ 66.666544][ T5848] do_filp_open+0x27f/0x4e0
[ 66.671039][ T5848] do_sys_openat2+0x13e/0x1d0
[ 66.675715][ T5848] __x64_sys_openat+0x247/0x2a0
[ 66.680660][ T5848] do_syscall_64+0xf3/0x230
[ 66.685165][ T5848] page last free pid 5201 tgid 5201 stack trace:
[ 66.691510][ T5848] free_frozen_pages+0xe04/0x10e0
[ 66.696699][ T5848] __put_partials+0x160/0x1c0
[ 66.701369][ T5848] put_cpu_partial+0x17c/0x250
[ 66.706204][ T5848] __slab_free+0x290/0x380
[ 66.710619][ T5848] qlist_free_all+0x9a/0x140
[ 66.715201][ T5848] kasan_quarantine_reduce+0x14f/0x170
[ 66.720742][ T5848] __kasan_slab_alloc+0x23/0x80
[ 66.725605][ T5848] kmem_cache_alloc_noprof+0x1d9/0x380
[ 66.731080][ T5848] getname_flags+0xb7/0x540
[ 66.735684][ T5848] do_sys_openat2+0xd2/0x1d0
[ 66.740263][ T5848] __x64_sys_openat+0x247/0x2a0
[ 66.745102][ T5848] do_syscall_64+0xf3/0x230
[ 66.749619][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.755540][ T5848]
[ 66.757853][ T5848] Memory state around the buggy address:
[ 66.763516][ T5848] ffff8880335be300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.771658][ T5848] ffff8880335be380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.779708][ T5848] >ffff8880335be400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.787753][ T5848] ^
[ 66.792090][ T5848] ffff8880335be480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.800141][ T5848] ffff8880335be500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.808188][ T5848] ==================================================================
[ 66.817245][ T5848] Kernel panic - not syncing: KASAN: panic_on_warn set ...
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 66.824645][ T5848] CPU: 0 UID: 0 PID: 5848 Comm: syz-executor Not tainted 6.13.0-syzkaller-09338-g05dbaf8dd8bf #0
[ 66.835422][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 66.845673][ T5848] Call Trace:
[ 66.848965][ T5848]
[ 66.851918][ T5848] dump_stack_lvl+0x241/0x360
[ 66.856615][ T5848] ? __pfx_dump_stack_lvl+0x10/0x10
[ 66.861928][ T5848] ? __pfx__printk+0x10/0x10
[ 66.866552][ T5848] ? preempt_schedule+0xe1/0xf0
[ 66.871427][ T5848] ? vscnprintf+0x5d/0x90
[ 66.875783][ T5848] panic+0x349/0x880
[ 66.879724][ T5848] ? check_panic_on_warn+0x21/0xb0
[ 66.884859][ T5848] ? __pfx_panic+0x10/0x10
[ 66.889329][ T5848] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 66.895518][ T5848] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 66.902043][ T5848] ? print_report+0x502/0x550
[ 66.906743][ T5848] check_panic_on_warn+0x86/0xb0
[ 66.911669][ T5848] ? binder_add_device+0x5f/0xa0
[ 66.916595][ T5848] end_report+0x77/0x160
[ 66.920937][ T5848] kasan_report+0x154/0x180
[ 66.925873][ T5848] ? binder_add_device+0x5f/0xa0
[ 66.930933][ T5848] binder_add_device+0x5f/0xa0
[ 66.935904][ T5848] binderfs_binder_device_create+0x7bf/0x9c0
[ 66.941928][ T5848] binderfs_fill_super+0x944/0xd90
[ 66.947308][ T5848] ? __pfx_binderfs_fill_super+0x10/0x10
[ 66.952937][ T5848] ? shrinker_register+0x160/0x230
[ 66.958049][ T5848] ? sget_fc+0x909/0x9c0
[ 66.962364][ T5848] ? __pfx_set_anon_super_fc+0x10/0x10
[ 66.967807][ T5848] ? __pfx_binderfs_fill_super+0x10/0x10
[ 66.973647][ T5848] get_tree_nodev+0xb7/0x140
[ 66.978242][ T5848] vfs_get_tree+0x90/0x2b0
[ 66.982685][ T5848] do_new_mount+0x2be/0xb40
[ 66.987191][ T5848] ? __pfx_do_new_mount+0x10/0x10
[ 66.992242][ T5848] __se_sys_mount+0x2d6/0x3c0
[ 66.997375][ T5848] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 67.003356][ T5848] ? __pfx___se_sys_mount+0x10/0x10
[ 67.008622][ T5848] ? do_syscall_64+0x100/0x230
[ 67.013561][ T5848] ? __x64_sys_mount+0x20/0xc0
[ 67.018341][ T5848] do_syscall_64+0xf3/0x230
[ 67.022921][ T5848] ? clear_bhb_loop+0x35/0x90
[ 67.027618][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 67.033776][ T5848] RIP: 0033:0x7f982138e54a
[ 67.038188][ T5848] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 67.058320][ T5848] RSP: 002b:00007ffc4996f9a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 67.066740][ T5848] RAX: ffffffffffffffda RBX: 00007f982140e663 RCX: 00007f982138e54a
[ 67.074716][ T5848] RDX: 00007f982141dda7 RSI: 00007f982140e663 RDI: 00007f982141dda7
[ 67.082772][ T5848] RBP: 00007f982140e8ac R08: 0000000000000000 R09: 00000000000001ff
[ 67.090838][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f98213eb1a8
[ 67.098901][ T5848] R13: 00007f98213eb180 R14: 0000000000000009 R15: 0000000000000000
[ 67.106870][ T5848]
[ 67.110256][ T5848] Kernel Offset: disabled
[ 67.114580][ T5848] Rebooting in 86400 seconds..