last executing test programs:
239.694618ms ago: executing program 3 (id=95):
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
238.56283ms ago: executing program 3 (id=99):
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
229.701045ms ago: executing program 4 (id=102):
socket$inet6_mptcp(0xa, 0x1, 0x106)
221.62706ms ago: executing program 2 (id=103):
socket$rds(0x15, 0x5, 0x0)
221.164697ms ago: executing program 3 (id=104):
socket$inet6(0xa, 0x1, 0x0)
172.204199ms ago: executing program 0 (id=105):
poll(&(0x7f0000000000), 0x0, 0x0)
171.294131ms ago: executing program 1 (id=106):
socket$inet6_sctp(0xa, 0x1, 0x84)
169.845564ms ago: executing program 2 (id=107):
socket$igmp6(0xa, 0x3, 0x2)
169.239183ms ago: executing program 0 (id=108):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0)
168.82368ms ago: executing program 4 (id=109):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/class/mac80211_hwsim/', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/class/mac80211_hwsim/', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/class/mac80211_hwsim/', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/class/mac80211_hwsim/', 0x800, 0x0)
167.500524ms ago: executing program 3 (id=110):
socket$igmp(0x2, 0x3, 0x2)
166.833418ms ago: executing program 0 (id=111):
gettid()
166.739143ms ago: executing program 1 (id=112):
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
159.389623ms ago: executing program 0 (id=113):
socket$nl_crypto(0x10, 0x3, 0x15)
159.290847ms ago: executing program 2 (id=114):
socket$inet_udp(0x2, 0x2, 0x0)
158.901859ms ago: executing program 3 (id=115):
syz_init_net_socket$bt_cmtp(0x1f, 0x3, 0x5)
148.359411ms ago: executing program 1 (id=116):
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
148.058837ms ago: executing program 4 (id=117):
socket$nl_route(0x10, 0x3, 0x0)
80.268636ms ago: executing program 2 (id=118):
socket$tipc(0x1e, 0x2, 0x0)
79.445338ms ago: executing program 0 (id=119):
socket$l2tp(0x2, 0x2, 0x73)
79.360228ms ago: executing program 4 (id=120):
socket$isdn_base(0x22, 0x3, 0x0)
78.864705ms ago: executing program 1 (id=121):
socket$inet6_tcp(0xa, 0x1, 0x0)
78.791428ms ago: executing program 4 (id=122):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
78.676295ms ago: executing program 1 (id=123):
pselect6(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
78.473185ms ago: executing program 0 (id=124):
syz_init_net_socket$x25(0x9, 0x5, 0x0)
78.111277ms ago: executing program 2 (id=125):
tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
71.001798ms ago: executing program 1 (id=126):
getpid()
58.202666ms ago: executing program 2 (id=127):
socket$unix(0x1, 0x1, 0x0)
12.228064ms ago: executing program 4 (id=128):
unshare(0x0)
0s ago: executing program 3 (id=131):
socket$vsock_stream(0x28, 0x1, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.4' (ED25519) to the list of known hosts.
[ 61.069230][ T5817] cgroup: Unknown subsys name 'net'
[ 61.239026][ T5817] cgroup: Unknown subsys name 'cpuset'
[ 61.248172][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 62.515622][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 64.512550][ T5865] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 64.585150][ T5875] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 65.649230][ T5971] ==================================================================
[ 65.657338][ T5971] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 65.665100][ T5971] Write of size 8 at addr ffff8881433ba408 by task syz-executor/5971
[ 65.673156][ T5971]
[ 65.675519][ T5971] CPU: 1 UID: 0 PID: 5971 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01199-ge016cf5f39e9 #0
[ 65.675534][ T5971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 65.675545][ T5971] Call Trace:
[ 65.675552][ T5971]
[ 65.675557][ T5971] dump_stack_lvl+0x241/0x360
[ 65.675577][ T5971] ? __pfx_dump_stack_lvl+0x10/0x10
[ 65.675591][ T5971] ? __pfx__printk+0x10/0x10
[ 65.675604][ T5971] ? _printk+0xd5/0x120
[ 65.675615][ T5971] ? __virt_addr_valid+0x183/0x530
[ 65.675628][ T5971] ? __virt_addr_valid+0x183/0x530
[ 65.675641][ T5971] print_report+0x16e/0x5b0
[ 65.675656][ T5971] ? __virt_addr_valid+0x183/0x530
[ 65.675668][ T5971] ? __virt_addr_valid+0x183/0x530
[ 65.675680][ T5971] ? __virt_addr_valid+0x45f/0x530
[ 65.675692][ T5971] ? __phys_addr+0xba/0x170
[ 65.675708][ T5971] ? binder_add_device+0x5f/0xa0
[ 65.675724][ T5971] kasan_report+0x143/0x180
[ 65.675739][ T5971] ? binder_add_device+0x5f/0xa0
[ 65.675757][ T5971] binder_add_device+0x5f/0xa0
[ 65.675774][ T5971] binderfs_binder_device_create+0x878/0xab0
[ 65.675795][ T5971] binderfs_fill_super+0x96e/0xe70
[ 65.675812][ T5971] ? __pfx_binderfs_fill_super+0x10/0x10
[ 65.675833][ T5971] ? shrinker_register+0x160/0x230
[ 65.675852][ T5971] ? sget_fc+0x960/0xa50
[ 65.675865][ T5971] ? __pfx_set_anon_super_fc+0x10/0x10
[ 65.675878][ T5971] ? __pfx_binderfs_fill_super+0x10/0x10
[ 65.675892][ T5971] get_tree_nodev+0xb7/0x140
[ 65.675906][ T5971] vfs_get_tree+0x90/0x2b0
[ 65.675920][ T5971] do_new_mount+0x2be/0xb40
[ 65.675938][ T5971] ? __pfx_do_new_mount+0x10/0x10
[ 65.675956][ T5971] __se_sys_mount+0x2d6/0x3c0
[ 65.675972][ T5971] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 65.675990][ T5971] ? __pfx___se_sys_mount+0x10/0x10
[ 65.676006][ T5971] ? do_syscall_64+0x100/0x230
[ 65.676023][ T5971] ? __x64_sys_mount+0x20/0xc0
[ 65.676040][ T5971] do_syscall_64+0xf3/0x230
[ 65.676055][ T5971] ? clear_bhb_loop+0x35/0x90
[ 65.676073][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 65.676093][ T5971] RIP: 0033:0x7fd2e498e90a
[ 65.676109][ T5971] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 65.676120][ T5971] RSP: 002b:00007fd2e4ccff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 65.676135][ T5971] RAX: ffffffffffffffda RBX: 00007fd2e4a0e663 RCX: 00007fd2e498e90a
[ 65.676145][ T5971] RDX: 00007fd2e4a1dda7 RSI: 00007fd2e4a0e663 RDI: 00007fd2e4a1dda7
[ 65.676154][ T5971] RBP: 00007fd2e4a0e8ac R08: 0000000000000000 R09: 0000000000000100
[ 65.676163][ T5971] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd2e49eb1a8
[ 65.676171][ T5971] R13: 00007fd2e49eb180 R14: 0000000000000009 R15: 0000000000000000
[ 65.676185][ T5971]
[ 65.676192][ T5971]
[ 65.950209][ T5971] Allocated by task 5828:
[ 65.954522][ T5971] kasan_save_track+0x3f/0x80
[ 65.959191][ T5971] __kasan_kmalloc+0x98/0xb0
[ 65.963779][ T5971] __kmalloc_cache_noprof+0x243/0x390
[ 65.969141][ T5971] binderfs_binder_device_create+0x171/0xab0
[ 65.975119][ T5971] binderfs_fill_super+0x96e/0xe70
[ 65.980255][ T5971] get_tree_nodev+0xb7/0x140
[ 65.984837][ T5971] vfs_get_tree+0x90/0x2b0
[ 65.989362][ T5971] do_new_mount+0x2be/0xb40
[ 65.993866][ T5971] __se_sys_mount+0x2d6/0x3c0
[ 65.998538][ T5971] do_syscall_64+0xf3/0x230
[ 66.003033][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.008917][ T5971]
[ 66.011225][ T5971] Freed by task 5828:
[ 66.015186][ T5971] kasan_save_track+0x3f/0x80
[ 66.019849][ T5971] kasan_save_free_info+0x40/0x50
[ 66.024866][ T5971] __kasan_slab_free+0x59/0x70
[ 66.029624][ T5971] kfree+0x196/0x430
[ 66.033503][ T5971] evict+0x4e8/0x9a0
[ 66.037381][ T5971] __dentry_kill+0x20d/0x630
[ 66.041966][ T5971] shrink_kill+0xa9/0x2c0
[ 66.046290][ T5971] shrink_dentry_list+0x2c0/0x5b0
[ 66.051312][ T5971] shrink_dcache_parent+0xcb/0x3b0
[ 66.056503][ T5971] do_one_tree+0x23/0xe0
[ 66.060764][ T5971] shrink_dcache_for_umount+0xb4/0x180
[ 66.066218][ T5971] generic_shutdown_super+0x6a/0x2d0
[ 66.071494][ T5971] kill_litter_super+0x76/0xb0
[ 66.076253][ T5971] binderfs_kill_super+0x44/0x90
[ 66.081185][ T5971] deactivate_locked_super+0xc4/0x130
[ 66.086639][ T5971] cleanup_mnt+0x41f/0x4b0
[ 66.091084][ T5971] task_work_run+0x24f/0x310
[ 66.095658][ T5971] do_exit+0xa2a/0x28e0
[ 66.099837][ T5971] do_group_exit+0x207/0x2c0
[ 66.104528][ T5971] get_signal+0x168c/0x1720
[ 66.109019][ T5971] arch_do_signal_or_restart+0x96/0x860
[ 66.114559][ T5971] syscall_exit_to_user_mode+0xce/0x340
[ 66.120099][ T5971] do_syscall_64+0x100/0x230
[ 66.124679][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.130564][ T5971]
[ 66.132878][ T5971] The buggy address belongs to the object at ffff8881433ba400
[ 66.132878][ T5971] which belongs to the cache kmalloc-512 of size 512
[ 66.146920][ T5971] The buggy address is located 8 bytes inside of
[ 66.146920][ T5971] freed 512-byte region [ffff8881433ba400, ffff8881433ba600)
[ 66.160532][ T5971]
[ 66.162845][ T5971] The buggy address belongs to the physical page:
[ 66.169264][ T5971] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1433b8
[ 66.178110][ T5971] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 66.186598][ T5971] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 66.194659][ T5971] page_type: f5(slab)
[ 66.198634][ T5971] raw: 057ff00000000040 ffff88801b041c80 0000000000000000 dead000000000001
[ 66.207296][ T5971] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 66.216042][ T5971] head: 057ff00000000040 ffff88801b041c80 0000000000000000 dead000000000001
[ 66.224718][ T5971] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 66.233383][ T5971] head: 057ff00000000002 ffffea00050cee01 ffffffffffffffff 0000000000000000
[ 66.242056][ T5971] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 66.250799][ T5971] page dumped because: kasan: bad access detected
[ 66.257200][ T5971] page_owner tracks the page as allocated
[ 66.262904][ T5971] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6877038946, free_ts 0
[ 66.282527][ T5971] post_alloc_hook+0x1f4/0x240
[ 66.287290][ T5971] get_page_from_freelist+0x365c/0x37a0
[ 66.292821][ T5971] __alloc_frozen_pages_noprof+0x292/0x710
[ 66.298641][ T5971] alloc_pages_mpol+0x311/0x660
[ 66.303483][ T5971] allocate_slab+0x8f/0x3a0
[ 66.307974][ T5971] ___slab_alloc+0xc27/0x14a0
[ 66.312637][ T5971] __slab_alloc+0x58/0xa0
[ 66.316955][ T5971] __kmalloc_cache_noprof+0x27b/0x390
[ 66.322311][ T5971] device_add+0xc1/0xbf0
[ 66.326544][ T5971] platform_device_add+0x45d/0x7c0
[ 66.331645][ T5971] platform_device_register_full+0x483/0x570
[ 66.337703][ T5971] vgem_init+0xe0/0x2a0
[ 66.341844][ T5971] do_one_initcall+0x248/0x930
[ 66.346592][ T5971] do_initcall_level+0x157/0x210
[ 66.351518][ T5971] do_initcalls+0x71/0xd0
[ 66.355865][ T5971] kernel_init_freeable+0x435/0x5d0
[ 66.361051][ T5971] page_owner free stack trace missing
[ 66.366405][ T5971]
[ 66.368714][ T5971] Memory state around the buggy address:
[ 66.374324][ T5971] ffff8881433ba300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.382374][ T5971] ffff8881433ba380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.390447][ T5971] >ffff8881433ba400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.398489][ T5971] ^
[ 66.402802][ T5971] ffff8881433ba480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.411109][ T5971] ffff8881433ba500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.419260][ T5971] ==================================================================
[ 66.449476][ T5971] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 66.456899][ T5971] CPU: 0 UID: 0 PID: 5971 Comm: syz-executor Not tainted 6.14.0-rc5-syzkaller-01199-ge016cf5f39e9 #0
[ 66.467760][ T5971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 66.478555][ T5971] Call Trace:
[ 66.481858][ T5971]
[ 66.484795][ T5971] dump_stack_lvl+0x241/0x360
[ 66.489582][ T5971] ? __pfx_dump_stack_lvl+0x10/0x10
[ 66.494803][ T5971] ? __pfx__printk+0x10/0x10
[ 66.499771][ T5971] ? preempt_schedule+0xe1/0xf0
[ 66.504651][ T5971] ? vscnprintf+0x5d/0x90
[ 66.508975][ T5971] panic+0x349/0x880
[ 66.512860][ T5971] ? check_panic_on_warn+0x21/0xb0
[ 66.517965][ T5971] ? __pfx_panic+0x10/0x10
[ 66.522407][ T5971] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 66.528529][ T5971] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 66.534866][ T5971] ? print_report+0x519/0x5b0
[ 66.539558][ T5971] check_panic_on_warn+0x86/0xb0
[ 66.544503][ T5971] ? binder_add_device+0x5f/0xa0
[ 66.549437][ T5971] end_report+0x77/0x160
[ 66.553700][ T5971] kasan_report+0x154/0x180
[ 66.558299][ T5971] ? binder_add_device+0x5f/0xa0
[ 66.563236][ T5971] binder_add_device+0x5f/0xa0
[ 66.567992][ T5971] binderfs_binder_device_create+0x878/0xab0
[ 66.573966][ T5971] binderfs_fill_super+0x96e/0xe70
[ 66.579072][ T5971] ? __pfx_binderfs_fill_super+0x10/0x10
[ 66.584706][ T5971] ? shrinker_register+0x160/0x230
[ 66.589904][ T5971] ? sget_fc+0x960/0xa50
[ 66.594135][ T5971] ? __pfx_set_anon_super_fc+0x10/0x10
[ 66.599578][ T5971] ? __pfx_binderfs_fill_super+0x10/0x10
[ 66.605292][ T5971] get_tree_nodev+0xb7/0x140
[ 66.609876][ T5971] vfs_get_tree+0x90/0x2b0
[ 66.614292][ T5971] do_new_mount+0x2be/0xb40
[ 66.618877][ T5971] ? __pfx_do_new_mount+0x10/0x10
[ 66.624070][ T5971] __se_sys_mount+0x2d6/0x3c0
[ 66.628766][ T5971] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 66.634766][ T5971] ? __pfx___se_sys_mount+0x10/0x10
[ 66.639976][ T5971] ? do_syscall_64+0x100/0x230
[ 66.644743][ T5971] ? __x64_sys_mount+0x20/0xc0
[ 66.649498][ T5971] do_syscall_64+0xf3/0x230
[ 66.653990][ T5971] ? clear_bhb_loop+0x35/0x90
[ 66.658750][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.664635][ T5971] RIP: 0033:0x7fd2e498e90a
[ 66.669037][ T5971] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 66.688820][ T5971] RSP: 002b:00007fd2e4ccff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 66.697321][ T5971] RAX: ffffffffffffffda RBX: 00007fd2e4a0e663 RCX: 00007fd2e498e90a
[ 66.705304][ T5971] RDX: 00007fd2e4a1dda7 RSI: 00007fd2e4a0e663 RDI: 00007fd2e4a1dda7
[ 66.713463][ T5971] RBP: 00007fd2e4a0e8ac R08: 0000000000000000 R09: 0000000000000100
[ 66.721541][ T5971] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd2e49eb1a8
[ 66.729537][ T5971] R13: 00007fd2e49eb180 R14: 0000000000000009 R15: 0000000000000000
[ 66.737683][ T5971]
[ 66.740947][ T5971] Kernel Offset: disabled
[ 66.745282][ T5971] Rebooting in 86400 seconds..