last executing test programs:

277.482957ms ago: executing program 1 (id=2):
write(0xffffffffffffffff, &(0x7f0000000000), 0x0)

270.212297ms ago: executing program 0 (id=1):
sendmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

234.636377ms ago: executing program 0 (id=6):
recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

189.548959ms ago: executing program 1 (id=7):
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000))

189.128008ms ago: executing program 1 (id=8):
close(0xffffffffffffffff)

189.002281ms ago: executing program 0 (id=9):
socket(0x1, 0x1, 0x0)

188.080902ms ago: executing program 1 (id=10):
mkdir(&(0x7f0000000000), 0x0)

182.741611ms ago: executing program 0 (id=11):
perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0)

162.587735ms ago: executing program 0 (id=12):
getpid()

162.514084ms ago: executing program 2 (id=3):
socket$kcm(0x29, 0x2, 0x0)

93.633447ms ago: executing program 1 (id=13):
unlink(&(0x7f0000000000))

93.482328ms ago: executing program 0 (id=14):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0)

93.414081ms ago: executing program 1 (id=15):
setsockopt(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0)

93.325271ms ago: executing program 2 (id=16):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)

39.131361ms ago: executing program 3 (id=4):
mkdirat(0xffffffffffffffff, &(0x7f0000000000), 0x0)

0s ago: executing program 4 (id=5):
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.142' (ED25519) to the list of known hosts.
[   61.343010][ T5817] cgroup: Unknown subsys name 'net'
[   61.455347][ T5817] cgroup: Unknown subsys name 'cpuset'
[   61.464666][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   62.824178][ T5817] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   65.203244][ T5853] ==================================================================
[   65.211382][ T5853] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[   65.219157][ T5853] Write of size 8 at addr ffff8880317e7408 by task syz-executor/5853
[   65.227590][ T5853] 
[   65.230082][ T5853] CPU: 0 UID: 0 PID: 5853 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-g46d38f489ef0 #0
[   65.230101][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   65.230119][ T5853] Call Trace:
[   65.230128][ T5853]  <TASK>
[   65.230136][ T5853]  dump_stack_lvl+0x241/0x360
[   65.230159][ T5853]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.230176][ T5853]  ? __pfx__printk+0x10/0x10
[   65.230192][ T5853]  ? _printk+0xd5/0x120
[   65.230206][ T5853]  ? __virt_addr_valid+0x183/0x530
[   65.230221][ T5853]  ? __virt_addr_valid+0x183/0x530
[   65.230237][ T5853]  print_report+0x16e/0x5b0
[   65.230257][ T5853]  ? __virt_addr_valid+0x183/0x530
[   65.230271][ T5853]  ? __virt_addr_valid+0x183/0x530
[   65.230299][ T5853]  ? __virt_addr_valid+0x45f/0x530
[   65.230313][ T5853]  ? __phys_addr+0xba/0x170
[   65.230333][ T5853]  ? binder_add_device+0x5f/0xa0
[   65.230353][ T5853]  kasan_report+0x143/0x180
[   65.230373][ T5853]  ? binder_add_device+0x5f/0xa0
[   65.230393][ T5853]  binder_add_device+0x5f/0xa0
[   65.230412][ T5853]  binderfs_binder_device_create+0x878/0xab0
[   65.230435][ T5853]  binderfs_fill_super+0x96e/0xe70
[   65.230455][ T5853]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.230481][ T5853]  ? shrinker_register+0x160/0x230
[   65.230499][ T5853]  ? sget_fc+0x960/0xa50
[   65.230515][ T5853]  ? __pfx_set_anon_super_fc+0x10/0x10
[   65.230533][ T5853]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.230551][ T5853]  get_tree_nodev+0xb7/0x140
[   65.230569][ T5853]  vfs_get_tree+0x90/0x2b0
[   65.230588][ T5853]  do_new_mount+0x2be/0xb40
[   65.230610][ T5853]  ? __pfx_do_new_mount+0x10/0x10
[   65.230633][ T5853]  __se_sys_mount+0x2d6/0x3c0
[   65.230654][ T5853]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   65.230677][ T5853]  ? __pfx___se_sys_mount+0x10/0x10
[   65.230698][ T5853]  ? do_syscall_64+0x100/0x230
[   65.230715][ T5853]  ? __x64_sys_mount+0x20/0xc0
[   65.230735][ T5853]  do_syscall_64+0xf3/0x230
[   65.230751][ T5853]  ? clear_bhb_loop+0x35/0x90
[   65.230772][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.230792][ T5853] RIP: 0033:0x7f6aa718e90a
[   65.230814][ T5853] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.230827][ T5853] RSP: 002b:00007ffe7811cc08 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   65.230845][ T5853] RAX: ffffffffffffffda RBX: 00007f6aa720e663 RCX: 00007f6aa718e90a
[   65.230857][ T5853] RDX: 00007f6aa721dda7 RSI: 00007f6aa720e663 RDI: 00007f6aa721dda7
[   65.230869][ T5853] RBP: 00007f6aa720e8ac R08: 0000000000000000 R09: 00000000000001ff
[   65.230879][ T5853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6aa71eb1a8
[   65.230890][ T5853] R13: 00007f6aa71eb180 R14: 0000000000000009 R15: 0000000000000000
[   65.230906][ T5853]  </TASK>
[   65.230912][ T5853] 
[   65.504411][ T5853] Allocated by task 5830:
[   65.508731][ T5853]  kasan_save_track+0x3f/0x80
[   65.513399][ T5853]  __kasan_kmalloc+0x98/0xb0
[   65.517982][ T5853]  __kmalloc_cache_noprof+0x243/0x390
[   65.523352][ T5853]  binderfs_binder_device_create+0x171/0xab0
[   65.529318][ T5853]  binderfs_fill_super+0x96e/0xe70
[   65.534414][ T5853]  get_tree_nodev+0xb7/0x140
[   65.538990][ T5853]  vfs_get_tree+0x90/0x2b0
[   65.543394][ T5853]  do_new_mount+0x2be/0xb40
[   65.547909][ T5853]  __se_sys_mount+0x2d6/0x3c0
[   65.552585][ T5853]  do_syscall_64+0xf3/0x230
[   65.557085][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.562981][ T5853] 
[   65.565291][ T5853] Freed by task 5830:
[   65.569254][ T5853]  kasan_save_track+0x3f/0x80
[   65.574621][ T5853]  kasan_save_free_info+0x40/0x50
[   65.579628][ T5853]  __kasan_slab_free+0x59/0x70
[   65.584375][ T5853]  kfree+0x196/0x430
[   65.588342][ T5853]  evict+0x4e8/0x9a0
[   65.592220][ T5853]  __dentry_kill+0x20d/0x630
[   65.596798][ T5853]  shrink_kill+0xa9/0x2c0
[   65.601109][ T5853]  shrink_dentry_list+0x2c0/0x5b0
[   65.606116][ T5853]  shrink_dcache_parent+0xcb/0x3b0
[   65.611331][ T5853]  do_one_tree+0x23/0xe0
[   65.615573][ T5853]  shrink_dcache_for_umount+0xb4/0x180
[   65.621108][ T5853]  generic_shutdown_super+0x6a/0x2d0
[   65.626378][ T5853]  kill_litter_super+0x76/0xb0
[   65.631128][ T5853]  binderfs_kill_super+0x44/0x90
[   65.636057][ T5853]  deactivate_locked_super+0xc4/0x130
[   65.641436][ T5853]  cleanup_mnt+0x41f/0x4b0
[   65.645864][ T5853]  task_work_run+0x24f/0x310
[   65.650453][ T5853]  do_exit+0xa2a/0x28e0
[   65.654614][ T5853]  do_group_exit+0x207/0x2c0
[   65.659265][ T5853]  get_signal+0x168c/0x1720
[   65.663838][ T5853]  arch_do_signal_or_restart+0x96/0x860
[   65.669385][ T5853]  syscall_exit_to_user_mode+0xce/0x340
[   65.674950][ T5853]  do_syscall_64+0x100/0x230
[   65.679551][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.685457][ T5853] 
[   65.687777][ T5853] The buggy address belongs to the object at ffff8880317e7400
[   65.687777][ T5853]  which belongs to the cache kmalloc-512 of size 512
[   65.702179][ T5853] The buggy address is located 8 bytes inside of
[   65.702179][ T5853]  freed 512-byte region [ffff8880317e7400, ffff8880317e7600)
[   65.715810][ T5853] 
[   65.718130][ T5853] The buggy address belongs to the physical page:
[   65.724550][ T5853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x317e4
[   65.733428][ T5853] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   65.741923][ T5853] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   65.749474][ T5853] page_type: f5(slab)
[   65.753461][ T5853] raw: 00fff00000000040 ffff88801b041c80 ffffea0000c22400 dead000000000002
[   65.762046][ T5853] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.770638][ T5853] head: 00fff00000000040 ffff88801b041c80 ffffea0000c22400 dead000000000002
[   65.779385][ T5853] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   65.788044][ T5853] head: 00fff00000000002 ffffea0000c5f901 ffffffffffffffff 0000000000000000
[   65.796696][ T5853] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   65.805360][ T5853] page dumped because: kasan: bad access detected
[   65.811857][ T5853] page_owner tracks the page as allocated
[   65.817556][ T5853] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15576883744, free_ts 0
[   65.837451][ T5853]  post_alloc_hook+0x1f4/0x240
[   65.842212][ T5853]  get_page_from_freelist+0x3a8c/0x3c20
[   65.847918][ T5853]  __alloc_frozen_pages_noprof+0x264/0x580
[   65.853710][ T5853]  alloc_pages_mpol+0x311/0x660
[   65.858675][ T5853]  allocate_slab+0x8f/0x3a0
[   65.863192][ T5853]  ___slab_alloc+0xc27/0x14a0
[   65.867869][ T5853]  __slab_alloc+0x58/0xa0
[   65.872214][ T5853]  __kmalloc_noprof+0x2e6/0x4c0
[   65.877080][ T5853]  __alloc_workqueue+0x11c/0x1bb0
[   65.882099][ T5853]  alloc_workqueue+0xd6/0x210
[   65.886849][ T5853]  vsock_loopback_init+0x1c/0x120
[   65.891869][ T5853]  do_one_initcall+0x248/0x930
[   65.896740][ T5853]  do_initcall_level+0x157/0x210
[   65.901673][ T5853]  do_initcalls+0x71/0xd0
[   65.905986][ T5853]  kernel_init_freeable+0x435/0x5d0
[   65.911259][ T5853]  kernel_init+0x1d/0x2b0
[   65.915576][ T5853] page_owner free stack trace missing
[   65.920932][ T5853] 
[   65.923346][ T5853] Memory state around the buggy address:
[   65.929082][ T5853]  ffff8880317e7300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.937322][ T5853]  ffff8880317e7380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.945478][ T5853] >ffff8880317e7400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.953524][ T5853]                       ^
[   65.957939][ T5853]  ffff8880317e7480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.966250][ T5853]  ffff8880317e7500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.974379][ T5853] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   66.002735][ T5853] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   66.009979][ T5853] CPU: 0 UID: 0 PID: 5853 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-g46d38f489ef0 #0
[   66.020323][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   66.030601][ T5853] Call Trace:
[   66.033893][ T5853]  <TASK>
[   66.036843][ T5853]  dump_stack_lvl+0x241/0x360
[   66.041537][ T5853]  ? __pfx_dump_stack_lvl+0x10/0x10
[   66.046746][ T5853]  ? __pfx__printk+0x10/0x10
[   66.051427][ T5853]  ? preempt_schedule+0xe1/0xf0
[   66.056295][ T5853]  ? vscnprintf+0x5d/0x90
[   66.060645][ T5853]  panic+0x349/0x880
[   66.064565][ T5853]  ? check_panic_on_warn+0x21/0xb0
[   66.069694][ T5853]  ? __pfx_panic+0x10/0x10
[   66.074131][ T5853]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   66.080136][ T5853]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   66.086674][ T5853]  ? print_report+0x519/0x5b0
[   66.091470][ T5853]  check_panic_on_warn+0x86/0xb0
[   66.096538][ T5853]  ? binder_add_device+0x5f/0xa0
[   66.101678][ T5853]  end_report+0x77/0x160
[   66.105952][ T5853]  kasan_report+0x154/0x180
[   66.110480][ T5853]  ? binder_add_device+0x5f/0xa0
[   66.115458][ T5853]  binder_add_device+0x5f/0xa0
[   66.120464][ T5853]  binderfs_binder_device_create+0x878/0xab0
[   66.126471][ T5853]  binderfs_fill_super+0x96e/0xe70
[   66.131605][ T5853]  ? __pfx_binderfs_fill_super+0x10/0x10
[   66.137359][ T5853]  ? shrinker_register+0x160/0x230
[   66.142512][ T5853]  ? sget_fc+0x960/0xa50
[   66.146780][ T5853]  ? __pfx_set_anon_super_fc+0x10/0x10
[   66.152348][ T5853]  ? __pfx_binderfs_fill_super+0x10/0x10
[   66.158101][ T5853]  get_tree_nodev+0xb7/0x140
[   66.162724][ T5853]  vfs_get_tree+0x90/0x2b0
[   66.167241][ T5853]  do_new_mount+0x2be/0xb40
[   66.171769][ T5853]  ? __pfx_do_new_mount+0x10/0x10
[   66.176985][ T5853]  __se_sys_mount+0x2d6/0x3c0
[   66.182394][ T5853]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   66.188402][ T5853]  ? __pfx___se_sys_mount+0x10/0x10
[   66.193635][ T5853]  ? do_syscall_64+0x100/0x230
[   66.198599][ T5853]  ? __x64_sys_mount+0x20/0xc0
[   66.203388][ T5853]  do_syscall_64+0xf3/0x230
[   66.208112][ T5853]  ? clear_bhb_loop+0x35/0x90
[   66.212947][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.218844][ T5853] RIP: 0033:0x7f6aa718e90a
[   66.223277][ T5853] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   66.243092][ T5853] RSP: 002b:00007ffe7811cc08 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   66.251508][ T5853] RAX: ffffffffffffffda RBX: 00007f6aa720e663 RCX: 00007f6aa718e90a
[   66.259475][ T5853] RDX: 00007f6aa721dda7 RSI: 00007f6aa720e663 RDI: 00007f6aa721dda7
[   66.267436][ T5853] RBP: 00007f6aa720e8ac R08: 0000000000000000 R09: 00000000000001ff
[   66.275418][ T5853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6aa71eb1a8
[   66.284014][ T5853] R13: 00007f6aa71eb180 R14: 0000000000000009 R15: 0000000000000000
[   66.291991][ T5853]  </TASK>
[   66.295243][ T5853] Kernel Offset: disabled
[   66.299569][ T5853] Rebooting in 86400 seconds..