last executing test programs:
215.91245ms ago: executing program 0 (id=6):
process_madvise(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)
194.165992ms ago: executing program 0 (id=7):
timerfd_create(0x0, 0x0)
179.497858ms ago: executing program 4 (id=5):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hpet', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hpet', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hpet', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hpet', 0x800, 0x0)
155.777193ms ago: executing program 1 (id=2):
shmat(0x0, 0x0, 0x0)
103.561975ms ago: executing program 0 (id=8):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock', 0x800, 0x0)
103.456808ms ago: executing program 3 (id=4):
syz_init_net_socket$ax25(0x3, 0x2, 0x0)
103.2959ms ago: executing program 0 (id=9):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log', 0x0, 0x0)
103.245536ms ago: executing program 2 (id=3):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/ambient', 0x2, 0x0)
103.151356ms ago: executing program 4 (id=10):
futex(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0)
86.486449ms ago: executing program 1 (id=11):
socket$rds(0x15, 0x5, 0x0)
86.395299ms ago: executing program 3 (id=12):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video36', 0x2, 0x0)
75.424848ms ago: executing program 0 (id=13):
fsync(0xffffffffffffffff)
27.620861ms ago: executing program 4 (id=14):
wait4(0x0, 0x0, 0x0, 0x0)
27.147019ms ago: executing program 2 (id=15):
syz_open_dev$sndhw(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndhw(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndhw(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndhw(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndhw(&(0x7f0000000140), 0xa, 0x0)
syz_open_dev$sndhw(&(0x7f0000000180), 0xa, 0x1)
syz_open_dev$sndhw(&(0x7f00000001c0), 0xa, 0x2)
syz_open_dev$sndhw(&(0x7f0000000200), 0xa, 0x800)
syz_open_dev$sndhw(&(0x7f0000000240), 0x14, 0x0)
syz_open_dev$sndhw(&(0x7f0000000280), 0x14, 0x1)
syz_open_dev$sndhw(&(0x7f00000002c0), 0x14, 0x2)
syz_open_dev$sndhw(&(0x7f0000000300), 0x14, 0x800)
syz_open_dev$sndhw(&(0x7f0000000340), 0x1e, 0x0)
syz_open_dev$sndhw(&(0x7f0000000380), 0x1e, 0x1)
syz_open_dev$sndhw(&(0x7f00000003c0), 0x1e, 0x2)
syz_open_dev$sndhw(&(0x7f0000000400), 0x1e, 0x800)
syz_open_dev$sndhw(&(0x7f0000000440), 0x28, 0x0)
syz_open_dev$sndhw(&(0x7f0000000480), 0x28, 0x1)
syz_open_dev$sndhw(&(0x7f00000004c0), 0x28, 0x2)
syz_open_dev$sndhw(&(0x7f0000000500), 0x28, 0x800)
26.950359ms ago: executing program 0 (id=16):
pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
26.85189ms ago: executing program 1 (id=17):
get_robust_list(0x0, &(0x7f0000000000), &(0x7f0000000000))
116.234µs ago: executing program 3 (id=18):
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
0s ago: executing program 4 (id=19):
getcwd(&(0x7f0000000000), 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts.
[ 57.581600][ T5824] cgroup: Unknown subsys name 'net'
[ 57.695278][ T5824] cgroup: Unknown subsys name 'cpuset'
[ 57.702577][ T5824] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 59.051637][ T5824] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 61.588835][ T5871] ==================================================================
[ 61.588872][ T5871] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 61.588923][ T5871] Write of
** replaying previous printk message **
[ 61.588923][ T5871] Write of size 8 at addr ffff888145f2dc08 by task syz-executor/5871
[ 61.588947][ T5871]
[ 61.588977][ T5871] CPU: 0 UID: 0 PID: 5871 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250117-syzkaller #0
[ 61.588995][ T5871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 61.589009][ T5871] Call Trace:
[ 61.589016][ T5871]
[ 61.589023][ T5871] dump_stack_lvl+0x241/0x360
[ 61.589043][ T5871] ? __pfx_dump_stack_lvl+0x10/0x10
[ 61.589059][ T5871] ? __pfx__printk+0x10/0x10
[ 61.589082][ T5871] ? _printk+0xd5/0x120
[ 61.589102][ T5871] ? __virt_addr_valid+0x183/0x530
[ 61.589124][ T5871] ? __virt_addr_valid+0x183/0x530
[ 61.589145][ T5871] print_report+0x169/0x550
[ 61.589166][ T5871] ? __virt_addr_valid+0x183/0x530
[ 61.589187][ T5871] ? __virt_addr_valid+0x183/0x530
[ 61.589207][ T5871] ? __virt_addr_valid+0x45f/0x530
[ 61.589227][ T5871] ? __phys_addr+0xba/0x170
[ 61.589247][ T5871] ? binder_add_device+0x5f/0xa0
[ 61.589263][ T5871] kasan_report+0x143/0x180
[ 61.589285][ T5871] ? binder_add_device+0x5f/0xa0
[ 61.589304][ T5871] binder_add_device+0x5f/0xa0
[ 61.589320][ T5871] binderfs_binder_device_create+0x7bf/0x9c0
[ 61.589340][ T5871] binderfs_fill_super+0x944/0xd90
[ 61.589359][ T5871] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.589383][ T5871] ? shrinker_register+0x160/0x230
[ 61.589402][ T5871] ? sget_fc+0x909/0x9c0
[ 61.589421][ T5871] ? __pfx_set_anon_super_fc+0x10/0x10
[ 61.589439][ T5871] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.589455][ T5871] get_tree_nodev+0xb7/0x140
[ 61.589474][ T5871] vfs_get_tree+0x90/0x2b0
[ 61.589495][ T5871] do_new_mount+0x2be/0xb40
[ 61.589523][ T5871] ? __pfx_do_new_mount+0x10/0x10
[ 61.589548][ T5871] __se_sys_mount+0x2d6/0x3c0
[ 61.589563][ T5871] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 61.589584][ T5871] ? __pfx___se_sys_mount+0x10/0x10
[ 61.589599][ T5871] ? do_syscall_64+0x100/0x230
[ 61.589618][ T5871] ? __x64_sys_mount+0x20/0xc0
[ 61.589634][ T5871] do_syscall_64+0xf3/0x230
[ 61.589651][ T5871] ? clear_bhb_loop+0x35/0x90
[ 61.589672][ T5871] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.589696][ T5871] RIP: 0033:0x7fe0de3874ca
[ 61.589714][ T5871] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 61.589728][ T5871] RSP: 002b:00007fe0de69ff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 61.589746][ T5871] RAX: ffffffffffffffda RBX: 00007fe0de401ecb RCX: 00007fe0de3874ca
[ 61.589758][ T5871] RDX: 00007fe0de40ec27 RSI: 00007fe0de401ecb RDI: 00007fe0de40ec27
[ 61.589768][ T5871] RBP: 00007fe0de4020c3 R08: 0000000000000000 R09: 0000000000000100
[ 61.589779][ T5871] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe0de3e41c8
[ 61.589789][ T5871] R13: 00007fe0de3e41a8 R14: 0000000000000009 R15: 0000000000000000
[ 61.589805][ T5871]
[ 61.589811][ T5871]
[ 61.590127][ T5871] Allocated by task 5836:
[ 61.590144][ T5871] kasan_save_track+0x3f/0x80
[ 61.590172][ T5871] __kasan_kmalloc+0x98/0xb0
[ 61.590200][ T5871] __kmalloc_cache_noprof+0x243/0x390
[ 61.590225][ T5871] binderfs_binder_device_create+0x16c/0x9c0
[ 61.590249][ T5871] binderfs_fill_super+0x944/0xd90
[ 61.590273][ T5871] get_tree_nodev+0xb7/0x140
[ 61.590298][ T5871] vfs_get_tree+0x90/0x2b0
[ 61.590325][ T5871] do_new_mount+0x2be/0xb40
[ 61.590354][ T5871] __se_sys_mount+0x2d6/0x3c0
[ 61.590377][ T5871] do_syscall_64+0xf3/0x230
[ 61.590401][ T5871] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.590429][ T5871]
[ 61.590443][ T5871] Freed by task 5836:
[ 61.590460][ T5871] kasan_save_track+0x3f/0x80
[ 61.590486][ T5871] kasan_save_free_info+0x40/0x50
[ 61.590511][ T5871] __kasan_slab_free+0x59/0x70
[ 61.590544][ T5871] kfree+0x196/0x430
[ 61.590566][ T5871] evict+0x4e8/0x9a0
[ 61.590592][ T5871] __dentry_kill+0x20d/0x630
[ 61.590616][ T5871] shrink_kill+0xa9/0x2c0
[ 61.590640][ T5871] shrink_dentry_list+0x2c0/0x5b0
[ 61.590664][ T5871] shrink_dcache_parent+0xcb/0x3b0
[ 61.590689][ T5871] do_one_tree+0x23/0xe0
[ 61.590713][ T5871] shrink_dcache_for_umount+0xb4/0x180
[ 61.590739][ T5871] generic_shutdown_super+0x6a/0x2d0
[ 61.590765][ T5871] kill_litter_super+0x76/0xb0
[ 61.590791][ T5871] binderfs_kill_super+0x44/0x90
[ 61.590814][ T5871] deactivate_locked_super+0xc4/0x130
[ 61.590839][ T5871] cleanup_mnt+0x41f/0x4b0
[ 61.590864][ T5871] task_work_run+0x24f/0x310
[ 61.590893][ T5871] do_exit+0xa2a/0x28e0
[ 61.590919][ T5871] do_group_exit+0x207/0x2c0
[ 61.590945][ T5871] get_signal+0x16b2/0x1750
[ 61.590968][ T5871] arch_do_signal_or_restart+0x96/0x860
[ 61.590994][ T5871] syscall_exit_to_user_mode+0xce/0x340
[ 61.591019][ T5871] do_syscall_64+0x100/0x230
[ 61.591044][ T5871] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.591075][ T5871]
[ 61.591089][ T5871] The buggy address belongs to the object at ffff888145f2dc00
[ 61.591089][ T5871] which belongs to the cache kmalloc-512 of size 512
[ 61.591112][ T5871] The buggy address is located 8 bytes inside of
[ 61.591112][ T5871] freed 512-byte region [ffff888145f2dc00, ffff888145f2de00)
[ 61.591138][ T5871]
[ 61.591152][ T5871] The buggy address belongs to the physical page:
[ 61.591169][ T5871] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x145f2c
[ 61.591203][ T5871] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 61.591226][ T5871] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 61.591251][ T5871] page_type: f5(slab)
[ 61.591272][ T5871] raw: 057ff00000000040 ffff88801ac41c80 ffffea00051bcd00 dead000000000002
[ 61.591292][ T5871] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 61.591314][ T5871] head: 057ff00000000040 ffff88801ac41c80 ffffea00051bcd00 dead000000000002
[ 61.591334][ T5871] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 61.591355][ T5871] head: 057ff00000000002 ffffea000517cb01 ffffffffffffffff 0000000000000000
[ 61.591374][ T5871] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 61.591388][ T5871] page dumped because: kasan: bad access detected
[ 61.591408][ T5871] page_owner tracks the page as allocated
[ 61.591423][ T5871] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8436145322, free_ts 0
[ 61.591461][ T5871] post_alloc_hook+0x1f4/0x240
[ 61.591486][ T5871] get_page_from_freelist+0x365c/0x37a0
[ 61.591519][ T5871] __alloc_frozen_pages_noprof+0x292/0x710
[ 61.591546][ T5871] alloc_pages_mpol+0x311/0x660
[ 61.591576][ T5871] allocate_slab+0x8f/0x3a0
[ 61.591602][ T5871] ___slab_alloc+0xc27/0x14a0
[ 61.591628][ T5871] __slab_alloc+0x58/0xa0
[ 61.591653][ T5871] __kmalloc_cache_noprof+0x27b/0x390
[ 61.591677][ T5871] device_add+0xc1/0xbf0
[ 61.591705][ T5871] usb_hub_create_port_device+0x3da/0xc10
[ 61.591733][ T5871] hub_probe+0x2503/0x3640
[ 61.591757][ T5871] usb_probe_interface+0x641/0xbb0
[ 61.591781][ T5871] really_probe+0x2b9/0xad0
[ 61.591799][ T5871] __driver_probe_device+0x1a2/0x390
[ 61.591825][ T5871] driver_probe_device+0x50/0x430
[ 61.591848][ T5871] __device_attach_driver+0x2d6/0x530
[ 61.591871][ T5871] page_owner free stack trace missing
[ 61.591886][ T5871]
[ 61.591899][ T5871] Memory state around the buggy address:
[ 61.591916][ T5871] ffff888145f2db00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 61.591935][ T5871] ffff888145f2db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 61.591956][ T5871] >ffff888145f2dc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.591972][ T5871] ^
[ 61.591990][ T5871] ffff888145f2dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.592010][ T5871] ffff888145f2dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.592026][ T5871] ==================================================================
[ 61.611176][ T5871] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 62.381540][ T5871] CPU: 0 UID: 0 PID: 5871 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250117-syzkaller #0
[ 62.391885][ T5871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 62.401925][ T5871] Call Trace:
[ 62.405193][ T5871]
[ 62.408124][ T5871] dump_stack_lvl+0x241/0x360
[ 62.412815][ T5871] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.418011][ T5871] ? __pfx__printk+0x10/0x10
[ 62.422693][ T5871] ? preempt_schedule+0xe1/0xf0
[ 62.427710][ T5871] ? vscnprintf+0x5d/0x90
[ 62.432032][ T5871] panic+0x349/0x880
[ 62.435922][ T5871] ? check_panic_on_warn+0x21/0xb0
[ 62.441027][ T5871] ? __pfx_panic+0x10/0x10
[ 62.445441][ T5871] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 62.451416][ T5871] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 62.457823][ T5871] ? print_report+0x502/0x550
[ 62.462497][ T5871] check_panic_on_warn+0x86/0xb0
[ 62.467429][ T5871] ? binder_add_device+0x5f/0xa0
[ 62.472360][ T5871] end_report+0x77/0x160
[ 62.476600][ T5871] kasan_report+0x154/0x180
[ 62.481104][ T5871] ? binder_add_device+0x5f/0xa0
[ 62.486036][ T5871] binder_add_device+0x5f/0xa0
[ 62.490807][ T5871] binderfs_binder_device_create+0x7bf/0x9c0
[ 62.497049][ T5871] binderfs_fill_super+0x944/0xd90
[ 62.502166][ T5871] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.507802][ T5871] ? shrinker_register+0x160/0x230
[ 62.512956][ T5871] ? sget_fc+0x909/0x9c0
[ 62.517195][ T5871] ? __pfx_set_anon_super_fc+0x10/0x10
[ 62.522651][ T5871] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.528275][ T5871] get_tree_nodev+0xb7/0x140
[ 62.532946][ T5871] vfs_get_tree+0x90/0x2b0
[ 62.537379][ T5871] do_new_mount+0x2be/0xb40
[ 62.541881][ T5871] ? __pfx_do_new_mount+0x10/0x10
[ 62.546903][ T5871] __se_sys_mount+0x2d6/0x3c0
[ 62.551574][ T5871] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 62.557548][ T5871] ? __pfx___se_sys_mount+0x10/0x10
[ 62.562737][ T5871] ? do_syscall_64+0x100/0x230
[ 62.567493][ T5871] ? __x64_sys_mount+0x20/0xc0
[ 62.572244][ T5871] do_syscall_64+0xf3/0x230
[ 62.576737][ T5871] ? clear_bhb_loop+0x35/0x90
[ 62.581409][ T5871] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.587382][ T5871] RIP: 0033:0x7fe0de3874ca
[ 62.591790][ T5871] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 62.611382][ T5871] RSP: 002b:00007fe0de69ff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 62.619796][ T5871] RAX: ffffffffffffffda RBX: 00007fe0de401ecb RCX: 00007fe0de3874ca
[ 62.627760][ T5871] RDX: 00007fe0de40ec27 RSI: 00007fe0de401ecb RDI: 00007fe0de40ec27
[ 62.635722][ T5871] RBP: 00007fe0de4020c3 R08: 0000000000000000 R09: 0000000000000100
[ 62.643979][ T5871] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe0de3e41c8
[ 62.651955][ T5871] R13: 00007fe0de3e41a8 R14: 0000000000000009 R15: 0000000000000000
[ 62.659959][ T5871]
[ 63.787299][ T5871] Shutting down cpus with NMI
[ 63.792489][ T5871] Kernel Offset: disabled
[ 63.796926][ T5871] Rebooting in 86400 seconds..