last executing test programs:

168.195697ms ago: executing program 1 (id=2):
setsockopt(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0)

157.924784ms ago: executing program 2 (id=3):
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000))

150.294244ms ago: executing program 3 (id=4):
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0)

145.442861ms ago: executing program 0 (id=1):
sendmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

133.543043ms ago: executing program 4 (id=5):
close(0xffffffffffffffff)

68.565222ms ago: executing program 3 (id=6):
mkdirat(0xffffffffffffffff, &(0x7f0000000000), 0x0)

67.011805ms ago: executing program 1 (id=7):
socket$kcm(0x29, 0x2, 0x0)

66.429079ms ago: executing program 0 (id=8):
recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

66.122706ms ago: executing program 2 (id=9):
write(0xffffffffffffffff, &(0x7f0000000000), 0x0)

66.072075ms ago: executing program 3 (id=10):
socket(0x1, 0x1, 0x0)

65.052082ms ago: executing program 0 (id=11):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0)

57.791133ms ago: executing program 4 (id=12):
perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0)

554.401µs ago: executing program 1 (id=13):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)

420.317µs ago: executing program 3 (id=14):
socket(0x1e, 0x2, 0x0)

344.838µs ago: executing program 2 (id=15):
getpid()

72.341µs ago: executing program 0 (id=16):
unlink(&(0x7f0000000000))

0s ago: executing program 4 (id=17):
mkdir(&(0x7f0000000000), 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.101' (ED25519) to the list of known hosts.
[   55.136828][ T5817] cgroup: Unknown subsys name 'net'
[   55.282969][ T5817] cgroup: Unknown subsys name 'cpuset'
[   55.291282][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   56.574550][ T5817] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   58.981668][ T5861] ==================================================================
[   58.989878][ T5861] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[   58.997650][ T5861] Write of size 8 at addr ffff888032dc5c08 by task syz-executor/5861
[   59.005734][ T5861] 
[   59.008088][ T5861] CPU: 1 UID: 0 PID: 5861 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-g46d38f489ef0 #0
[   59.008106][ T5861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   59.008123][ T5861] Call Trace:
[   59.008133][ T5861]  <TASK>
[   59.008140][ T5861]  dump_stack_lvl+0x241/0x360
[   59.008162][ T5861]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.008177][ T5861]  ? __pfx__printk+0x10/0x10
[   59.008193][ T5861]  ? _printk+0xd5/0x120
[   59.008206][ T5861]  ? __virt_addr_valid+0x183/0x530
[   59.008219][ T5861]  ? __virt_addr_valid+0x183/0x530
[   59.008234][ T5861]  print_report+0x16e/0x5b0
[   59.008253][ T5861]  ? __virt_addr_valid+0x183/0x530
[   59.008267][ T5861]  ? __virt_addr_valid+0x183/0x530
[   59.008279][ T5861]  ? __virt_addr_valid+0x45f/0x530
[   59.008293][ T5861]  ? __phys_addr+0xba/0x170
[   59.008313][ T5861]  ? binder_add_device+0x5f/0xa0
[   59.008330][ T5861]  kasan_report+0x143/0x180
[   59.008348][ T5861]  ? binder_add_device+0x5f/0xa0
[   59.008369][ T5861]  binder_add_device+0x5f/0xa0
[   59.008391][ T5861]  binderfs_binder_device_create+0x878/0xab0
[   59.008413][ T5861]  binderfs_fill_super+0x96e/0xe70
[   59.008434][ T5861]  ? __pfx_binderfs_fill_super+0x10/0x10
[   59.008459][ T5861]  ? shrinker_register+0x160/0x230
[   59.008477][ T5861]  ? sget_fc+0x960/0xa50
[   59.008493][ T5861]  ? __pfx_set_anon_super_fc+0x10/0x10
[   59.008510][ T5861]  ? __pfx_binderfs_fill_super+0x10/0x10
[   59.008528][ T5861]  get_tree_nodev+0xb7/0x140
[   59.008545][ T5861]  vfs_get_tree+0x90/0x2b0
[   59.008564][ T5861]  do_new_mount+0x2be/0xb40
[   59.008586][ T5861]  ? __pfx_do_new_mount+0x10/0x10
[   59.008609][ T5861]  __se_sys_mount+0x2d6/0x3c0
[   59.008636][ T5861]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   59.008659][ T5861]  ? __pfx___se_sys_mount+0x10/0x10
[   59.008679][ T5861]  ? exc_page_fault+0x590/0x8b0
[   59.008701][ T5861]  ? __x64_sys_mount+0x20/0xc0
[   59.008722][ T5861]  do_syscall_64+0xf3/0x230
[   59.008737][ T5861]  ? clear_bhb_loop+0x35/0x90
[   59.008758][ T5861]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.008778][ T5861] RIP: 0033:0x7f62dc38e90a
[   59.008797][ T5861] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   59.008810][ T5861] RSP: 002b:00007ffc6bb078e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   59.008828][ T5861] RAX: ffffffffffffffda RBX: 00007f62dc40e663 RCX: 00007f62dc38e90a
[   59.008839][ T5861] RDX: 00007f62dc41dda7 RSI: 00007f62dc40e663 RDI: 00007f62dc41dda7
[   59.008851][ T5861] RBP: 00007ffc6bb07960 R08: 0000000000000000 R09: 0000000000000000
[   59.008860][ T5861] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6bb07960
[   59.008870][ T5861] R13: 00007ffc6bb07968 R14: 0000000000000009 R15: 0000000000000000
[   59.008886][ T5861]  </TASK>
[   59.008892][ T5861] 
[   59.281426][ T5861] Allocated by task 5831:
[   59.285765][ T5861]  kasan_save_track+0x3f/0x80
[   59.290456][ T5861]  __kasan_kmalloc+0x98/0xb0
[   59.295045][ T5861]  __kmalloc_cache_noprof+0x243/0x390
[   59.300413][ T5861]  binderfs_binder_device_create+0x171/0xab0
[   59.306383][ T5861]  binderfs_fill_super+0x96e/0xe70
[   59.311482][ T5861]  get_tree_nodev+0xb7/0x140
[   59.316065][ T5861]  vfs_get_tree+0x90/0x2b0
[   59.320469][ T5861]  do_new_mount+0x2be/0xb40
[   59.324957][ T5861]  __se_sys_mount+0x2d6/0x3c0
[   59.329622][ T5861]  do_syscall_64+0xf3/0x230
[   59.334113][ T5861]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.339996][ T5861] 
[   59.342303][ T5861] Freed by task 5831:
[   59.346277][ T5861]  kasan_save_track+0x3f/0x80
[   59.350944][ T5861]  kasan_save_free_info+0x40/0x50
[   59.355951][ T5861]  __kasan_slab_free+0x59/0x70
[   59.360702][ T5861]  kfree+0x196/0x430
[   59.364588][ T5861]  evict+0x4e8/0x9a0
[   59.368467][ T5861]  __dentry_kill+0x20d/0x630
[   59.373045][ T5861]  shrink_kill+0xa9/0x2c0
[   59.377359][ T5861]  shrink_dentry_list+0x2c0/0x5b0
[   59.382368][ T5861]  shrink_dcache_parent+0xcb/0x3b0
[   59.387465][ T5861]  do_one_tree+0x23/0xe0
[   59.391693][ T5861]  shrink_dcache_for_umount+0xb4/0x180
[   59.397135][ T5861]  generic_shutdown_super+0x6a/0x2d0
[   59.402404][ T5861]  kill_litter_super+0x76/0xb0
[   59.407154][ T5861]  binderfs_kill_super+0x44/0x90
[   59.412077][ T5861]  deactivate_locked_super+0xc4/0x130
[   59.417433][ T5861]  cleanup_mnt+0x41f/0x4b0
[   59.421833][ T5861]  task_work_run+0x24f/0x310
[   59.426411][ T5861]  do_exit+0xa2a/0x28e0
[   59.430556][ T5861]  do_group_exit+0x207/0x2c0
[   59.435314][ T5861]  get_signal+0x168c/0x1720
[   59.439893][ T5861]  arch_do_signal_or_restart+0x96/0x860
[   59.445429][ T5861]  syscall_exit_to_user_mode+0xce/0x340
[   59.450962][ T5861]  do_syscall_64+0x100/0x230
[   59.455536][ T5861]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.461427][ T5861] 
[   59.463735][ T5861] The buggy address belongs to the object at ffff888032dc5c00
[   59.463735][ T5861]  which belongs to the cache kmalloc-512 of size 512
[   59.477946][ T5861] The buggy address is located 8 bytes inside of
[   59.477946][ T5861]  freed 512-byte region [ffff888032dc5c00, ffff888032dc5e00)
[   59.491583][ T5861] 
[   59.493897][ T5861] The buggy address belongs to the physical page:
[   59.500299][ T5861] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32dc4
[   59.509062][ T5861] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   59.517544][ T5861] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   59.525635][ T5861] page_type: f5(slab)
[   59.529618][ T5861] raw: 00fff00000000040 ffff88801b041c80 ffffea0000a91400 0000000000000003
[   59.538198][ T5861] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   59.546785][ T5861] head: 00fff00000000040 ffff88801b041c80 ffffea0000a91400 0000000000000003
[   59.555469][ T5861] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   59.564124][ T5861] head: 00fff00000000002 ffffea0000cb7101 ffffffffffffffff 0000000000000000
[   59.572780][ T5861] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[   59.581428][ T5861] page dumped because: kasan: bad access detected
[   59.587916][ T5861] page_owner tracks the page as allocated
[   59.593623][ T5861] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5205, tgid 5205 (udevd), ts 33263658737, free_ts 33187288258
[   59.614372][ T5861]  post_alloc_hook+0x1f4/0x240
[   59.619124][ T5861]  get_page_from_freelist+0x3a8c/0x3c20
[   59.624658][ T5861]  __alloc_frozen_pages_noprof+0x264/0x580
[   59.630535][ T5861]  alloc_pages_mpol+0x311/0x660
[   59.635492][ T5861]  allocate_slab+0x8f/0x3a0
[   59.639998][ T5861]  ___slab_alloc+0xc27/0x14a0
[   59.644667][ T5861]  __slab_alloc+0x58/0xa0
[   59.649074][ T5861]  __kmalloc_cache_noprof+0x27b/0x390
[   59.654434][ T5861]  kernfs_fop_open+0x3e0/0xd10
[   59.659358][ T5861]  do_dentry_open+0xdec/0x1960
[   59.664111][ T5861]  vfs_open+0x3b/0x370
[   59.668175][ T5861]  path_openat+0x2c81/0x3590
[   59.672752][ T5861]  do_filp_open+0x27f/0x4e0
[   59.677339][ T5861]  do_sys_openat2+0x13e/0x1d0
[   59.682006][ T5861]  __x64_sys_openat+0x247/0x2a0
[   59.686845][ T5861]  do_syscall_64+0xf3/0x230
[   59.691337][ T5861] page last free pid 5477 tgid 5477 stack trace:
[   59.697650][ T5861]  __free_frozen_pages+0xd7f/0x1020
[   59.702835][ T5861]  __slab_free+0x2c2/0x380
[   59.707239][ T5861]  qlist_free_all+0x9a/0x140
[   59.711815][ T5861]  kasan_quarantine_reduce+0x14f/0x170
[   59.717265][ T5861]  __kasan_slab_alloc+0x23/0x80
[   59.722139][ T5861]  __kmalloc_noprof+0x236/0x4c0
[   59.726980][ T5861]  tomoyo_supervisor+0xe57/0x1860
[   59.732163][ T5861]  tomoyo_env_perm+0x178/0x210
[   59.736925][ T5861]  tomoyo_find_next_domain+0x1495/0x1dd0
[   59.742555][ T5861]  tomoyo_bprm_check_security+0x117/0x180
[   59.748275][ T5861]  security_bprm_check+0x86/0x250
[   59.753285][ T5861]  bprm_execve+0x8d3/0x1430
[   59.757776][ T5861]  do_execveat_common+0x57f/0x710
[   59.762785][ T5861]  __x64_sys_execve+0x92/0xb0
[   59.767458][ T5861]  do_syscall_64+0xf3/0x230
[   59.771944][ T5861]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.777826][ T5861] 
[   59.780146][ T5861] Memory state around the buggy address:
[   59.785758][ T5861]  ffff888032dc5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.793804][ T5861]  ffff888032dc5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.801850][ T5861] >ffff888032dc5c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.809893][ T5861]                       ^
[   59.814209][ T5861]  ffff888032dc5c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.822253][ T5861]  ffff888032dc5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.830380][ T5861] ==================================================================
[   59.886403][ T5861] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   59.894082][ T5861] CPU: 1 UID: 0 PID: 5861 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-g46d38f489ef0 #0
[   59.904552][ T5861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   59.914708][ T5861] Call Trace:
[   59.918001][ T5861]  <TASK>
[   59.920943][ T5861]  dump_stack_lvl+0x241/0x360
[   59.925647][ T5861]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.930861][ T5861]  ? __pfx__printk+0x10/0x10
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   59.935496][ T5861]  ? preempt_schedule+0xe1/0xf0
[   59.940430][ T5861]  ? vscnprintf+0x5d/0x90
[   59.944864][ T5861]  panic+0x349/0x880
[   59.948788][ T5861]  ? check_panic_on_warn+0x21/0xb0
[   59.953936][ T5861]  ? __pfx_panic+0x10/0x10
[   59.958375][ T5861]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   59.964374][ T5861]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   59.970707][ T5861]  ? print_report+0x519/0x5b0
[   59.975518][ T5861]  check_panic_on_warn+0x86/0xb0
[   59.980452][ T5861]  ? binder_add_device+0x5f/0xa0
[   59.985376][ T5861]  end_report+0x77/0x160
[   59.989610][ T5861]  kasan_report+0x154/0x180
[   59.994108][ T5861]  ? binder_add_device+0x5f/0xa0
[   59.999044][ T5861]  binder_add_device+0x5f/0xa0
[   60.003800][ T5861]  binderfs_binder_device_create+0x878/0xab0
[   60.009777][ T5861]  binderfs_fill_super+0x96e/0xe70
[   60.014879][ T5861]  ? __pfx_binderfs_fill_super+0x10/0x10
[   60.020534][ T5861]  ? shrinker_register+0x160/0x230
[   60.025754][ T5861]  ? sget_fc+0x960/0xa50
[   60.029996][ T5861]  ? __pfx_set_anon_super_fc+0x10/0x10
[   60.035538][ T5861]  ? __pfx_binderfs_fill_super+0x10/0x10
[   60.041160][ T5861]  get_tree_nodev+0xb7/0x140
[   60.045742][ T5861]  vfs_get_tree+0x90/0x2b0
[   60.050149][ T5861]  do_new_mount+0x2be/0xb40
[   60.054653][ T5861]  ? __pfx_do_new_mount+0x10/0x10
[   60.059718][ T5861]  __se_sys_mount+0x2d6/0x3c0
[   60.064388][ T5861]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   60.070447][ T5861]  ? __pfx___se_sys_mount+0x10/0x10
[   60.075639][ T5861]  ? exc_page_fault+0x590/0x8b0
[   60.080482][ T5861]  ? __x64_sys_mount+0x20/0xc0
[   60.085236][ T5861]  do_syscall_64+0xf3/0x230
[   60.089726][ T5861]  ? clear_bhb_loop+0x35/0x90
[   60.094401][ T5861]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.100283][ T5861] RIP: 0033:0x7f62dc38e90a
[   60.104684][ T5861] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   60.124291][ T5861] RSP: 002b:00007ffc6bb078e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   60.132700][ T5861] RAX: ffffffffffffffda RBX: 00007f62dc40e663 RCX: 00007f62dc38e90a
[   60.140745][ T5861] RDX: 00007f62dc41dda7 RSI: 00007f62dc40e663 RDI: 00007f62dc41dda7
[   60.148787][ T5861] RBP: 00007ffc6bb07960 R08: 0000000000000000 R09: 0000000000000000
[   60.156765][ T5861] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6bb07960
[   60.164736][ T5861] R13: 00007ffc6bb07968 R14: 0000000000000009 R15: 0000000000000000
[   60.172700][ T5861]  </TASK>
[   60.175992][ T5861] Kernel Offset: disabled
[   60.180305][ T5861] Rebooting in 86400 seconds..