last executing test programs: 135.090054ms ago: executing program 0 (id=255): sched_setaffinity(0x0, 0x0, &(0x7f0000000000)) 134.973956ms ago: executing program 2 (id=256): readlink(&(0x7f0000000000), &(0x7f0000000000), 0x0) 134.747846ms ago: executing program 3 (id=259): fchmod(0xffffffffffffffff, 0x0) 134.566161ms ago: executing program 0 (id=260): getsockname(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 134.498917ms ago: executing program 1 (id=261): mbind(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) 134.456555ms ago: executing program 2 (id=262): pselect6(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) 75.281001ms ago: executing program 3 (id=263): unlinkat(0xffffffffffffffff, &(0x7f0000000000), 0x0) 75.172249ms ago: executing program 0 (id=264): cachestat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 74.99255ms ago: executing program 1 (id=265): map_shadow_stack(0x0, 0x0, 0x0) 74.960394ms ago: executing program 2 (id=266): listen(0xffffffffffffffff, 0x0) 74.920381ms ago: executing program 3 (id=267): setreuid(0x0, 0x0) 74.8863ms ago: executing program 0 (id=268): io_cancel(0x0, &(0x7f0000000000), &(0x7f0000000000)) 74.8295ms ago: executing program 1 (id=269): times(&(0x7f0000000000)) 69.417609ms ago: executing program 3 (id=270): getegid() 69.111215ms ago: executing program 2 (id=271): pread64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 53.262505ms ago: executing program 1 (id=272): utimensat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 935.075µs ago: executing program 0 (id=273): acct(0x0) 725.608µs ago: executing program 3 (id=274): shmdt(0x0) 651.232µs ago: executing program 2 (id=275): execveat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0) 472.187µs ago: executing program 1 (id=276): pivot_root(&(0x7f0000000000), &(0x7f0000000000)) 251.336µs ago: executing program 3 (id=277): preadv2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 174.497µs ago: executing program 0 (id=278): mkdir(&(0x7f0000000000), 0x0) 115.312µs ago: executing program 1 (id=279): getgroups(0x0, &(0x7f0000000000)) 0s ago: executing program 2 (id=280): splice(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts. [ 65.045525][ T5820] cgroup: Unknown subsys name 'net' [ 65.162204][ T5820] cgroup: Unknown subsys name 'cpuset' [ 65.171742][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.692561][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 69.977581][ T6072] mmap: syz.0.230 (6072) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 70.550616][ T5889] ================================================================== [ 70.558725][ T5889] BUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x335/0x340 [ 70.566914][ T5889] Write of size 8 at addr ffff8880290d5c08 by task syz.1.52/5889 [ 70.574652][ T5889] [ 70.576997][ T5889] CPU: 0 UID: 0 PID: 5889 Comm: syz.1.52 Not tainted 6.14.0-rc6-syzkaller-00016-g0fed89a961ea #0 [ 70.577025][ T5889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 70.577041][ T5889] Call Trace: [ 70.577049][ T5889] [ 70.577058][ T5889] dump_stack_lvl+0x116/0x1f0 [ 70.577104][ T5889] print_report+0xc3/0x670 [ 70.577126][ T5889] ? __virt_addr_valid+0x5e/0x590 [ 70.577149][ T5889] ? __phys_addr+0xc6/0x150 [ 70.577172][ T5889] kasan_report+0xd9/0x110 [ 70.577193][ T5889] ? binderfs_evict_inode+0x335/0x340 [ 70.577227][ T5889] ? binderfs_evict_inode+0x335/0x340 [ 70.577262][ T5889] ? __pfx_binderfs_evict_inode+0x10/0x10 [ 70.577294][ T5889] binderfs_evict_inode+0x335/0x340 [ 70.577326][ T5889] evict+0x409/0x960 [ 70.577351][ T5889] ? __pfx_evict+0x10/0x10 [ 70.577380][ T5889] iput+0x52a/0x890 [ 70.577405][ T5889] dentry_unlink_inode+0x29c/0x480 [ 70.577436][ T5889] __dentry_kill+0x1d0/0x600 [ 70.577459][ T5889] ? shrink_dentry_list+0x11a/0x5d0 [ 70.577487][ T5889] shrink_dentry_list+0x140/0x5d0 [ 70.577515][ T5889] ? shrink_dcache_parent+0x75/0x530 [ 70.577542][ T5889] shrink_dcache_parent+0xe2/0x530 [ 70.577569][ T5889] ? __pfx_shrink_dcache_parent+0x10/0x10 [ 70.577602][ T5889] shrink_dcache_for_umount+0xa1/0x3e0 [ 70.577632][ T5889] generic_shutdown_super+0x6c/0x390 [ 70.577660][ T5889] kill_litter_super+0x70/0xa0 [ 70.577687][ T5889] binderfs_kill_super+0x3b/0xa0 [ 70.577717][ T5889] deactivate_locked_super+0xbe/0x1a0 [ 70.577746][ T5889] deactivate_super+0xde/0x100 [ 70.577775][ T5889] cleanup_mnt+0x222/0x450 [ 70.577804][ T5889] task_work_run+0x14e/0x250 [ 70.577834][ T5889] ? __pfx_task_work_run+0x10/0x10 [ 70.577862][ T5889] ? __put_net+0x3a/0x70 [ 70.577887][ T5889] do_exit+0xad8/0x2d70 [ 70.577913][ T5889] ? proc_coredump_connector+0x2d2/0x4f0 [ 70.577947][ T5889] ? __pfx_do_exit+0x10/0x10 [ 70.577975][ T5889] do_group_exit+0xd3/0x2a0 [ 70.577999][ T5889] get_signal+0x24ed/0x26c0 [ 70.578036][ T5889] ? force_sig_fault+0xc5/0x110 [ 70.578068][ T5889] ? __pfx_get_signal+0x10/0x10 [ 70.578104][ T5889] arch_do_signal_or_restart+0x90/0x7e0 [ 70.578132][ T5889] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 70.578157][ T5889] ? __bad_area_nosemaphore+0x334/0x6a0 [ 70.578189][ T5889] ? do_user_addr_fault+0x920/0x13f0 [ 70.578222][ T5889] irqentry_exit_to_user_mode+0x13f/0x280 [ 70.578255][ T5889] asm_exc_page_fault+0x26/0x30 [ 70.578286][ T5889] RIP: 0033:0x0 [ 70.578301][ T5889] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 70.578312][ T5889] RSP: 002b:0000400000000008 EFLAGS: 00010217 [ 70.578331][ T5889] RAX: 0000000000000000 RBX: 00007f566aba5fa0 RCX: 00007f566a98d169 [ 70.578346][ T5889] RDX: 0000400000000000 RSI: 0000400000000000 RDI: 0000000000000000 [ 70.578361][ T5889] RBP: 00007f566aa0e2a0 R08: 0000400000000000 R09: 0000000000000000 [ 70.578376][ T5889] R10: 0000400000000000 R11: 0000000000000246 R12: 0000000000000000 [ 70.578390][ T5889] R13: 00007f566aba5fa0 R14: 00007f566aba5fa0 R15: 0000000000000005 [ 70.578418][ T5889] [ 70.578426][ T5889] [ 70.875287][ T5889] Allocated by task 5829: [ 70.879611][ T5889] kasan_save_stack+0x33/0x60 [ 70.884296][ T5889] kasan_save_track+0x14/0x30 [ 70.888975][ T5889] __kasan_kmalloc+0xaa/0xb0 [ 70.893564][ T5889] binderfs_binder_device_create.isra.0+0x17a/0xb70 [ 70.900156][ T5889] binderfs_fill_super+0x8d6/0x1360 [ 70.905358][ T5889] get_tree_nodev+0xda/0x190 [ 70.909959][ T5889] vfs_get_tree+0x8b/0x340 [ 70.914632][ T5889] path_mount+0x14e6/0x1f10 [ 70.919126][ T5889] __x64_sys_mount+0x28f/0x310 [ 70.923882][ T5889] do_syscall_64+0xcd/0x250 [ 70.928392][ T5889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.934288][ T5889] [ 70.936600][ T5889] Freed by task 5829: [ 70.940566][ T5889] kasan_save_stack+0x33/0x60 [ 70.945247][ T5889] kasan_save_track+0x14/0x30 [ 70.949925][ T5889] kasan_save_free_info+0x3b/0x60 [ 70.954946][ T5889] __kasan_slab_free+0x51/0x70 [ 70.959711][ T5889] kfree+0x2c4/0x4d0 [ 70.963603][ T5889] binderfs_evict_inode+0x29f/0x340 [ 70.968803][ T5889] evict+0x409/0x960 [ 70.972692][ T5889] iput+0x52a/0x890 [ 70.976495][ T5889] dentry_unlink_inode+0x29c/0x480 [ 70.981600][ T5889] __dentry_kill+0x1d0/0x600 [ 70.986184][ T5889] shrink_dentry_list+0x140/0x5d0 [ 70.991208][ T5889] shrink_dcache_parent+0xe2/0x530 [ 70.996350][ T5889] shrink_dcache_for_umount+0xa1/0x3e0 [ 71.001816][ T5889] generic_shutdown_super+0x6c/0x390 [ 71.007105][ T5889] kill_litter_super+0x70/0xa0 [ 71.011869][ T5889] binderfs_kill_super+0x3b/0xa0 [ 71.016811][ T5889] deactivate_locked_super+0xbe/0x1a0 [ 71.022181][ T5889] deactivate_super+0xde/0x100 [ 71.026944][ T5889] cleanup_mnt+0x222/0x450 [ 71.031359][ T5889] task_work_run+0x14e/0x250 [ 71.035953][ T5889] do_exit+0xad8/0x2d70 [ 71.040108][ T5889] do_group_exit+0xd3/0x2a0 [ 71.044608][ T5889] get_signal+0x24ed/0x26c0 [ 71.049110][ T5889] arch_do_signal_or_restart+0x90/0x7e0 [ 71.054677][ T5889] syscall_exit_to_user_mode+0x150/0x2a0 [ 71.060314][ T5889] do_syscall_64+0xda/0x250 [ 71.064817][ T5889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.070710][ T5889] [ 71.073036][ T5889] The buggy address belongs to the object at ffff8880290d5c00 [ 71.073036][ T5889] which belongs to the cache kmalloc-512 of size 512 [ 71.087095][ T5889] The buggy address is located 8 bytes inside of [ 71.087095][ T5889] freed 512-byte region [ffff8880290d5c00, ffff8880290d5e00) [ 71.100892][ T5889] [ 71.103212][ T5889] The buggy address belongs to the physical page: [ 71.109622][ T5889] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880290d5800 pfn:0x290d4 [ 71.119683][ T5889] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 71.128175][ T5889] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 71.136157][ T5889] page_type: f5(slab) [ 71.140177][ T5889] raw: 00fff00000000040 ffff88801b041c80 0000000000000000 dead000000000001 [ 71.148757][ T5889] raw: ffff8880290d5800 000000000010000f 00000000f5000000 0000000000000000 [ 71.157376][ T5889] head: 00fff00000000040 ffff88801b041c80 0000000000000000 dead000000000001 [ 71.166178][ T5889] head: ffff8880290d5800 000000000010000f 00000000f5000000 0000000000000000 [ 71.174854][ T5889] head: 00fff00000000002 ffffea0000a43501 ffffffffffffffff 0000000000000000 [ 71.183516][ T5889] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 71.192196][ T5889] page dumped because: kasan: bad access detected [ 71.198611][ T5889] page_owner tracks the page as allocated [ 71.204320][ T5889] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5222, tgid 5222 (udevadm), ts 30673243450, free_ts 30319293045 [ 71.225252][ T5889] post_alloc_hook+0x181/0x1b0 [ 71.230032][ T5889] get_page_from_freelist+0xfce/0x2f80 [ 71.235517][ T5889] __alloc_frozen_pages_noprof+0x221/0x2470 [ 71.241421][ T5889] alloc_pages_mpol+0x1fc/0x540 [ 71.246264][ T5889] new_slab+0x23d/0x330 [ 71.250420][ T5889] ___slab_alloc+0xc5d/0x1720 [ 71.255093][ T5889] __slab_alloc.constprop.0+0x56/0xb0 [ 71.260471][ T5889] __kmalloc_cache_noprof+0xfa/0x410 [ 71.265761][ T5889] kernfs_fop_open+0x28b/0xdb0 [ 71.270518][ T5889] do_dentry_open+0x735/0x1c40 [ 71.275280][ T5889] vfs_open+0x82/0x3f0 [ 71.279374][ T5889] path_openat+0x1e88/0x2d80 [ 71.284055][ T5889] do_filp_open+0x20c/0x470 [ 71.288581][ T5889] do_sys_openat2+0x17a/0x1e0 [ 71.293260][ T5889] __x64_sys_openat+0x175/0x210 [ 71.298111][ T5889] do_syscall_64+0xcd/0x250 [ 71.302617][ T5889] page last free pid 25 tgid 25 stack trace: [ 71.308594][ T5889] free_frozen_pages+0x6db/0xfb0 [ 71.313537][ T5889] rcu_core+0x79d/0x14d0 [ 71.317770][ T5889] handle_softirqs+0x213/0x8f0 [ 71.322534][ T5889] run_ksoftirqd+0x3a/0x60 [ 71.326950][ T5889] smpboot_thread_fn+0x661/0xa30 [ 71.331884][ T5889] kthread+0x3af/0x750 [ 71.335951][ T5889] ret_from_fork+0x45/0x80 [ 71.340370][ T5889] ret_from_fork_asm+0x1a/0x30 [ 71.345135][ T5889] [ 71.347458][ T5889] Memory state around the buggy address: [ 71.353085][ T5889] ffff8880290d5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.361149][ T5889] ffff8880290d5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.369381][ T5889] >ffff8880290d5c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.377433][ T5889] ^ [ 71.381748][ T5889] ffff8880290d5c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.389802][ T5889] ffff8880290d5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 71.397850][ T5889] ================================================================== [ 71.503518][ T5889] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 71.510758][ T5889] CPU: 0 UID: 0 PID: 5889 Comm: syz.1.52 Not tainted 6.14.0-rc6-syzkaller-00016-g0fed89a961ea #0 [ 71.521280][ T5889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 71.531443][ T5889] Call Trace: [ 71.534739][ T5889] [ 71.537699][ T5889] dump_stack_lvl+0x3d/0x1f0 [ 71.542322][ T5889] panic+0x71d/0x800 [ 71.546276][ T5889] ? __pfx_panic+0x10/0x10 [ 71.550726][ T5889] ? preempt_schedule_thunk+0x1a/0x30 [ 71.556129][ T5889] ? preempt_schedule_common+0x44/0xc0 [ 71.561716][ T5889] ? check_panic_on_warn+0x1f/0xb0 [ 71.566863][ T5889] check_panic_on_warn+0xab/0xb0 [ 71.571838][ T5889] end_report+0x117/0x180 [ 71.576197][ T5889] kasan_report+0xe9/0x110 [ 71.580648][ T5889] ? binderfs_evict_inode+0x335/0x340 [ 71.586062][ T5889] ? binderfs_evict_inode+0x335/0x340 [ 71.591477][ T5889] ? __pfx_binderfs_evict_inode+0x10/0x10 [ 71.597231][ T5889] binderfs_evict_inode+0x335/0x340 [ 71.602467][ T5889] evict+0x409/0x960 [ 71.606400][ T5889] ? __pfx_evict+0x10/0x10 [ 71.610849][ T5889] iput+0x52a/0x890 [ 71.614688][ T5889] dentry_unlink_inode+0x29c/0x480 [ 71.619832][ T5889] __dentry_kill+0x1d0/0x600 [ 71.624453][ T5889] ? shrink_dentry_list+0x11a/0x5d0 [ 71.629686][ T5889] shrink_dentry_list+0x140/0x5d0 [ 71.634741][ T5889] ? shrink_dcache_parent+0x75/0x530 [ 71.640061][ T5889] shrink_dcache_parent+0xe2/0x530 [ 71.645205][ T5889] ? __pfx_shrink_dcache_parent+0x10/0x10 [ 71.650978][ T5889] shrink_dcache_for_umount+0xa1/0x3e0 [ 71.656477][ T5889] generic_shutdown_super+0x6c/0x390 [ 71.661796][ T5889] kill_litter_super+0x70/0xa0 [ 71.666592][ T5889] binderfs_kill_super+0x3b/0xa0 [ 71.671573][ T5889] deactivate_locked_super+0xbe/0x1a0 [ 71.677068][ T5889] deactivate_super+0xde/0x100 [ 71.681881][ T5889] cleanup_mnt+0x222/0x450 [ 71.686339][ T5889] task_work_run+0x14e/0x250 [ 71.690971][ T5889] ? __pfx_task_work_run+0x10/0x10 [ 71.696162][ T5889] ? __put_net+0x3a/0x70 [ 71.700442][ T5889] do_exit+0xad8/0x2d70 [ 71.704633][ T5889] ? proc_coredump_connector+0x2d2/0x4f0 [ 71.710303][ T5889] ? __pfx_do_exit+0x10/0x10 [ 71.714942][ T5889] do_group_exit+0xd3/0x2a0 [ 71.719476][ T5889] get_signal+0x24ed/0x26c0 [ 71.724018][ T5889] ? force_sig_fault+0xc5/0x110 [ 71.728903][ T5889] ? __pfx_get_signal+0x10/0x10 [ 71.733800][ T5889] arch_do_signal_or_restart+0x90/0x7e0 [ 71.739446][ T5889] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 71.745629][ T5889] ? __bad_area_nosemaphore+0x334/0x6a0 [ 71.751238][ T5889] ? do_user_addr_fault+0x920/0x13f0 [ 71.756571][ T5889] irqentry_exit_to_user_mode+0x13f/0x280 [ 71.762338][ T5889] asm_exc_page_fault+0x26/0x30 [ 71.767226][ T5889] RIP: 0033:0x0 [ 71.770702][ T5889] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 71.778120][ T5889] RSP: 002b:0000400000000008 EFLAGS: 00010217 [ 71.784213][ T5889] RAX: 0000000000000000 RBX: 00007f566aba5fa0 RCX: 00007f566a98d169 [ 71.792230][ T5889] RDX: 0000400000000000 RSI: 0000400000000000 RDI: 0000000000000000 [ 71.800322][ T5889] RBP: 00007f566aa0e2a0 R08: 0000400000000000 R09: 0000000000000000 [ 71.808319][ T5889] R10: 0000400000000000 R11: 0000000000000246 R12: 0000000000000000 [ 71.816311][ T5889] R13: 00007f566aba5fa0 R14: 00007f566aba5fa0 R15: 0000000000000005 [ 71.824320][ T5889] [ 71.827639][ T5889] Kernel Offset: disabled [ 71.831958][ T5889] Rebooting in 86400 seconds..