last executing test programs:
194.691738ms ago: executing program 2 (id=3):
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0)
180.94917ms ago: executing program 3 (id=4):
perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0)
136.333789ms ago: executing program 2 (id=6):
write(0xffffffffffffffff, &(0x7f0000000000), 0x0)
135.641252ms ago: executing program 3 (id=7):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun', 0x800, 0x0)
135.528604ms ago: executing program 2 (id=8):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0)
135.454632ms ago: executing program 1 (id=2):
sendmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)
123.065345ms ago: executing program 0 (id=1):
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000))
114.196384ms ago: executing program 3 (id=9):
getpid()
68.459617ms ago: executing program 1 (id=10):
socket(0x1e, 0x2, 0x0)
68.220439ms ago: executing program 0 (id=11):
recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)
67.85274ms ago: executing program 3 (id=12):
close(0xffffffffffffffff)
67.338332ms ago: executing program 2 (id=13):
mkdirat(0xffffffffffffffff, &(0x7f0000000000), 0x0)
67.287247ms ago: executing program 3 (id=14):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0)
59.218001ms ago: executing program 1 (id=15):
gettid()
56.351176ms ago: executing program 2 (id=16):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)
418.497µs ago: executing program 0 (id=17):
socket(0x1, 0x1, 0x0)
264.852µs ago: executing program 1 (id=18):
unlink(&(0x7f0000000000))
172.131µs ago: executing program 3 (id=19):
mkdir(&(0x7f0000000000), 0x0)
0s ago: executing program 4 (id=5):
setsockopt(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.134' (ED25519) to the list of known hosts.
[ 58.066988][ T5817] cgroup: Unknown subsys name 'net'
[ 58.197541][ T5817] cgroup: Unknown subsys name 'cpuset'
[ 58.205344][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 59.458236][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 61.888533][ T5860] ==================================================================
[ 61.896646][ T5860] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 61.904408][ T5860] Write of size 8 at addr ffff888144396808 by task syz-executor/5860
[ 61.912479][ T5860]
[ 61.914823][ T5860] CPU: 0 UID: 0 PID: 5860 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-ga68894afa205 #0
[ 61.914843][ T5860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 61.914859][ T5860] Call Trace:
[ 61.914869][ T5860]
[ 61.914875][ T5860] dump_stack_lvl+0x241/0x360
[ 61.914899][ T5860] ? __pfx_dump_stack_lvl+0x10/0x10
[ 61.914916][ T5860] ? __pfx__printk+0x10/0x10
[ 61.914932][ T5860] ? _printk+0xd5/0x120
[ 61.914947][ T5860] ? __virt_addr_valid+0x183/0x530
[ 61.914962][ T5860] ? __virt_addr_valid+0x183/0x530
[ 61.914978][ T5860] print_report+0x16e/0x5b0
[ 61.914997][ T5860] ? __virt_addr_valid+0x183/0x530
[ 61.915012][ T5860] ? __virt_addr_valid+0x183/0x530
[ 61.915026][ T5860] ? __virt_addr_valid+0x45f/0x530
[ 61.915039][ T5860] ? __phys_addr+0xba/0x170
[ 61.915061][ T5860] ? binder_add_device+0x5f/0xa0
[ 61.915079][ T5860] kasan_report+0x143/0x180
[ 61.915100][ T5860] ? binder_add_device+0x5f/0xa0
[ 61.915120][ T5860] binder_add_device+0x5f/0xa0
[ 61.915139][ T5860] binderfs_binder_device_create+0x878/0xab0
[ 61.915162][ T5860] binderfs_fill_super+0x96e/0xe70
[ 61.915183][ T5860] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.915210][ T5860] ? shrinker_register+0x160/0x230
[ 61.915228][ T5860] ? sget_fc+0x960/0xa50
[ 61.915245][ T5860] ? __pfx_set_anon_super_fc+0x10/0x10
[ 61.915263][ T5860] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.915281][ T5860] get_tree_nodev+0xb7/0x140
[ 61.915306][ T5860] vfs_get_tree+0x90/0x2b0
[ 61.915326][ T5860] do_new_mount+0x2be/0xb40
[ 61.915349][ T5860] ? __pfx_do_new_mount+0x10/0x10
[ 61.915373][ T5860] __se_sys_mount+0x2d6/0x3c0
[ 61.915394][ T5860] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 61.915416][ T5860] ? __pfx___se_sys_mount+0x10/0x10
[ 61.915438][ T5860] ? do_syscall_64+0x100/0x230
[ 61.915454][ T5860] ? __x64_sys_mount+0x20/0xc0
[ 61.915476][ T5860] do_syscall_64+0xf3/0x230
[ 61.915491][ T5860] ? clear_bhb_loop+0x35/0x90
[ 61.915512][ T5860] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.915532][ T5860] RIP: 0033:0x7f567838e90a
[ 61.915551][ T5860] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 61.915564][ T5860] RSP: 002b:00007ffd7310c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 61.915583][ T5860] RAX: ffffffffffffffda RBX: 00007f567840e663 RCX: 00007f567838e90a
[ 61.915595][ T5860] RDX: 00007f567841dda7 RSI: 00007f567840e663 RDI: 00007f567841dda7
[ 61.915606][ T5860] RBP: 00007f567840e8ac R08: 0000000000000000 R09: 00007ffd7310c230
[ 61.915617][ T5860] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f56783eb1a8
[ 61.915627][ T5860] R13: 00007f56783eb180 R14: 0000000000000009 R15: 0000000000000000
[ 61.915644][ T5860]
[ 61.915650][ T5860]
[ 62.187728][ T5860] Allocated by task 5831:
[ 62.192038][ T5860] kasan_save_track+0x3f/0x80
[ 62.196796][ T5860] __kasan_kmalloc+0x98/0xb0
[ 62.201380][ T5860] __kmalloc_cache_noprof+0x243/0x390
[ 62.206758][ T5860] binderfs_binder_device_create+0x171/0xab0
[ 62.212762][ T5860] binderfs_fill_super+0x96e/0xe70
[ 62.217885][ T5860] get_tree_nodev+0xb7/0x140
[ 62.222497][ T5860] vfs_get_tree+0x90/0x2b0
[ 62.226904][ T5860] do_new_mount+0x2be/0xb40
[ 62.231398][ T5860] __se_sys_mount+0x2d6/0x3c0
[ 62.236064][ T5860] do_syscall_64+0xf3/0x230
[ 62.240553][ T5860] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.246436][ T5860]
[ 62.248745][ T5860] Freed by task 5831:
[ 62.253141][ T5860] kasan_save_track+0x3f/0x80
[ 62.257803][ T5860] kasan_save_free_info+0x40/0x50
[ 62.262819][ T5860] __kasan_slab_free+0x59/0x70
[ 62.267570][ T5860] kfree+0x196/0x430
[ 62.271452][ T5860] evict+0x4e8/0x9a0
[ 62.275334][ T5860] __dentry_kill+0x20d/0x630
[ 62.279918][ T5860] shrink_kill+0xa9/0x2c0
[ 62.284232][ T5860] shrink_dentry_list+0x2c0/0x5b0
[ 62.289262][ T5860] shrink_dcache_parent+0xcb/0x3b0
[ 62.294390][ T5860] do_one_tree+0x23/0xe0
[ 62.298616][ T5860] shrink_dcache_for_umount+0xb4/0x180
[ 62.304062][ T5860] generic_shutdown_super+0x6a/0x2d0
[ 62.309344][ T5860] kill_litter_super+0x76/0xb0
[ 62.314100][ T5860] binderfs_kill_super+0x44/0x90
[ 62.319132][ T5860] deactivate_locked_super+0xc4/0x130
[ 62.324610][ T5860] cleanup_mnt+0x41f/0x4b0
[ 62.329037][ T5860] task_work_run+0x24f/0x310
[ 62.333703][ T5860] do_exit+0xa2a/0x28e0
[ 62.337866][ T5860] do_group_exit+0x207/0x2c0
[ 62.342458][ T5860] get_signal+0x168c/0x1720
[ 62.346963][ T5860] arch_do_signal_or_restart+0x96/0x860
[ 62.352521][ T5860] syscall_exit_to_user_mode+0xce/0x340
[ 62.358075][ T5860] do_syscall_64+0x100/0x230
[ 62.362665][ T5860] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.368560][ T5860]
[ 62.371043][ T5860] The buggy address belongs to the object at ffff888144396800
[ 62.371043][ T5860] which belongs to the cache kmalloc-512 of size 512
[ 62.385080][ T5860] The buggy address is located 8 bytes inside of
[ 62.385080][ T5860] freed 512-byte region [ffff888144396800, ffff888144396a00)
[ 62.398704][ T5860]
[ 62.401019][ T5860] The buggy address belongs to the physical page:
[ 62.407421][ T5860] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144394
[ 62.416296][ T5860] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 62.424787][ T5860] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 62.432442][ T5860] page_type: f5(slab)
[ 62.436499][ T5860] raw: 057ff00000000040 ffff88801b041c80 ffffea000510e300 dead000000000002
[ 62.445160][ T5860] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 62.453729][ T5860] head: 057ff00000000040 ffff88801b041c80 ffffea000510e300 dead000000000002
[ 62.462442][ T5860] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 62.471111][ T5860] head: 057ff00000000002 ffffea000510e501 ffffffffffffffff 0000000000000000
[ 62.479769][ T5860] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 62.488437][ T5860] page dumped because: kasan: bad access detected
[ 62.494857][ T5860] page_owner tracks the page as allocated
[ 62.500563][ T5860] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8362473861, free_ts 0
[ 62.520181][ T5860] post_alloc_hook+0x1f4/0x240
[ 62.524936][ T5860] get_page_from_freelist+0x3a8c/0x3c20
[ 62.530487][ T5860] __alloc_frozen_pages_noprof+0x264/0x580
[ 62.536401][ T5860] alloc_pages_mpol+0x311/0x660
[ 62.541256][ T5860] allocate_slab+0x8f/0x3a0
[ 62.545750][ T5860] ___slab_alloc+0xc27/0x14a0
[ 62.550443][ T5860] __slab_alloc+0x58/0xa0
[ 62.554768][ T5860] __kmalloc_cache_noprof+0x27b/0x390
[ 62.560134][ T5860] device_add+0xc1/0xbf0
[ 62.564364][ T5860] usb_new_device+0x104a/0x19a0
[ 62.569202][ T5860] register_root_hub+0x25c/0x550
[ 62.574132][ T5860] usb_add_hcd+0xb49/0x1110
[ 62.578642][ T5860] dummy_hcd_probe+0x158/0x2b0
[ 62.583394][ T5860] platform_probe+0x13a/0x1c0
[ 62.588053][ T5860] really_probe+0x2b9/0xad0
[ 62.592539][ T5860] __driver_probe_device+0x1a2/0x390
[ 62.597809][ T5860] page_owner free stack trace missing
[ 62.603291][ T5860]
[ 62.605607][ T5860] Memory state around the buggy address:
[ 62.611480][ T5860] ffff888144396700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.619526][ T5860] ffff888144396780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.627570][ T5860] >ffff888144396800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.635610][ T5860] ^
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 62.639915][ T5860] ffff888144396880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.647959][ T5860] ffff888144396900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.656004][ T5860] ==================================================================
[ 62.706237][ T5860] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 62.713471][ T5860] CPU: 0 UID: 0 PID: 5860 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-ga68894afa205 #0
[ 62.723782][ T5860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 62.733833][ T5860] Call Trace:
[ 62.737103][ T5860]
[ 62.740025][ T5860] dump_stack_lvl+0x241/0x360
[ 62.744778][ T5860] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.749957][ T5860] ? __pfx__printk+0x10/0x10
[ 62.754531][ T5860] ? preempt_schedule+0xe1/0xf0
[ 62.759545][ T5860] ? vscnprintf+0x5d/0x90
[ 62.763858][ T5860] panic+0x349/0x880
[ 62.767740][ T5860] ? check_panic_on_warn+0x21/0xb0
[ 62.772844][ T5860] ? __pfx_panic+0x10/0x10
[ 62.777243][ T5860] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 62.783247][ T5860] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 62.789559][ T5860] ? print_report+0x519/0x5b0
[ 62.794224][ T5860] check_panic_on_warn+0x86/0xb0
[ 62.799155][ T5860] ? binder_add_device+0x5f/0xa0
[ 62.804082][ T5860] end_report+0x77/0x160
[ 62.808310][ T5860] kasan_report+0x154/0x180
[ 62.812796][ T5860] ? binder_add_device+0x5f/0xa0
[ 62.817727][ T5860] binder_add_device+0x5f/0xa0
[ 62.822476][ T5860] binderfs_binder_device_create+0x878/0xab0
[ 62.828444][ T5860] binderfs_fill_super+0x96e/0xe70
[ 62.833539][ T5860] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.839259][ T5860] ? shrinker_register+0x160/0x230
[ 62.844354][ T5860] ? sget_fc+0x960/0xa50
[ 62.848583][ T5860] ? __pfx_set_anon_super_fc+0x10/0x10
[ 62.854028][ T5860] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.859646][ T5860] get_tree_nodev+0xb7/0x140
[ 62.864220][ T5860] vfs_get_tree+0x90/0x2b0
[ 62.868651][ T5860] do_new_mount+0x2be/0xb40
[ 62.873155][ T5860] ? __pfx_do_new_mount+0x10/0x10
[ 62.878180][ T5860] __se_sys_mount+0x2d6/0x3c0
[ 62.882952][ T5860] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 62.888927][ T5860] ? __pfx___se_sys_mount+0x10/0x10
[ 62.894113][ T5860] ? do_syscall_64+0x100/0x230
[ 62.898868][ T5860] ? __x64_sys_mount+0x20/0xc0
[ 62.903618][ T5860] do_syscall_64+0xf3/0x230
[ 62.908107][ T5860] ? clear_bhb_loop+0x35/0x90
[ 62.912770][ T5860] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.918649][ T5860] RIP: 0033:0x7f567838e90a
[ 62.923050][ T5860] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 62.942639][ T5860] RSP: 002b:00007ffd7310c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 62.951040][ T5860] RAX: ffffffffffffffda RBX: 00007f567840e663 RCX: 00007f567838e90a
[ 62.958997][ T5860] RDX: 00007f567841dda7 RSI: 00007f567840e663 RDI: 00007f567841dda7
[ 62.966957][ T5860] RBP: 00007f567840e8ac R08: 0000000000000000 R09: 00007ffd7310c230
[ 62.974913][ T5860] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f56783eb1a8
[ 62.982868][ T5860] R13: 00007f56783eb180 R14: 0000000000000009 R15: 0000000000000000
[ 62.990922][ T5860]
[ 62.994059][ T5860] Kernel Offset: disabled
[ 62.998383][ T5860] Rebooting in 86400 seconds..