Warning: Permanently added '10.128.0.94' (ED25519) to the list of known hosts.
2025/05/04 10:34:23 ignoring optional flag "sandboxArg"="0"
2025/05/04 10:34:24 parsed 1 programs
[ 96.834164][ T5829] cgroup: Unknown subsys name 'net'
[ 96.972496][ T5829] cgroup: Unknown subsys name 'cpuset'
[ 96.981820][ T5829] cgroup: Unknown subsys name 'rlimit'
[ 97.149817][ T974] cfg80211: failed to load regulatory.db
[ 98.654507][ T5829] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 102.106317][ T5843] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 102.529492][ T5863] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 102.537852][ T5863] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 102.546245][ T5863] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 102.554398][ T5863] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 102.568603][ T5863] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 102.579676][ T5849] ==================================================================
[ 102.587804][ T5849] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 102.595584][ T5849] Write of size 8 at addr ffff888034245c08 by task syz-executor/5849
[ 102.603712][ T5849]
[ 102.606090][ T5849] CPU: 0 UID: 0 PID: 5849 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00746-g836b313a14a3 #0 PREEMPT(full)
[ 102.606132][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
[ 102.606149][ T5849] Call Trace:
[ 102.606160][ T5849]
[ 102.606169][ T5849] dump_stack_lvl+0x189/0x250
[ 102.606201][ T5849] ? __kasan_check_byte+0x12/0x40
[ 102.606228][ T5849] ? __pfx_dump_stack_lvl+0x10/0x10
[ 102.606256][ T5849] ? lock_release+0x4b/0x3e0
[ 102.606283][ T5849] ? lock_release+0x4b/0x3e0
[ 102.606312][ T5849] ? __virt_addr_valid+0x469/0x540
[ 102.606339][ T5849] print_report+0xb4/0x290
[ 102.606381][ T5849] ? binder_add_device+0x5f/0xa0
[ 102.606405][ T5849] kasan_report+0x118/0x150
[ 102.606429][ T5849] ? binder_add_device+0x5f/0xa0
[ 102.606458][ T5849] binder_add_device+0x5f/0xa0
[ 102.606482][ T5849] binderfs_binder_device_create+0x8b7/0xaf0
[ 102.606513][ T5849] binderfs_fill_super+0xa0e/0xe90
[ 102.606541][ T5849] ? __pfx_binderfs_fill_super+0x10/0x10
[ 102.606585][ T5849] ? shrinker_register+0x16b/0x230
[ 102.606605][ T5849] ? sget_fc+0x962/0xa40
[ 102.606624][ T5849] ? __pfx_set_anon_super_fc+0x10/0x10
[ 102.606644][ T5849] ? __pfx_binderfs_fill_super+0x10/0x10
[ 102.606666][ T5849] get_tree_nodev+0xb8/0x150
[ 102.606687][ T5849] vfs_get_tree+0x8f/0x2b0
[ 102.606710][ T5849] do_new_mount+0x24a/0xa40
[ 102.606739][ T5849] __se_sys_mount+0x317/0x410
[ 102.606766][ T5849] ? __pfx___se_sys_mount+0x10/0x10
[ 102.606793][ T5849] ? do_syscall_64+0xba/0x210
[ 102.606820][ T5849] ? __x64_sys_mount+0x20/0xc0
[ 102.606846][ T5849] do_syscall_64+0xf6/0x210
[ 102.606874][ T5849] ? clear_bhb_loop+0x45/0xa0
[ 102.606895][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.606914][ T5849] RIP: 0033:0x7f978af9010a
[ 102.606936][ T5849] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 102.606953][ T5849] RSP: 002b:00007ffcd906bce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 102.606980][ T5849] RAX: ffffffffffffffda RBX: 00007f978b010e74 RCX: 00007f978af9010a
[ 102.606994][ T5849] RDX: 00007f978b0208cb RSI: 00007f978b010e74 RDI: 00007f978b0208cb
[ 102.607008][ T5849] RBP: 00007f978b0110bd R08: 0000000000000000 R09: 00000000000001ff
[ 102.607020][ T5849] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f978afec1a8
[ 102.607032][ T5849] R13: 00007f978afec180 R14: 0000000000000009 R15: 0000000000000000
[ 102.607053][ T5849]
[ 102.607060][ T5849]
[ 102.852291][ T5849] Allocated by task 5843:
[ 102.856725][ T5849] kasan_save_track+0x3e/0x80
[ 102.861440][ T5849] __kasan_kmalloc+0x93/0xb0
[ 102.866058][ T5849] __kmalloc_cache_noprof+0x230/0x3d0
[ 102.871470][ T5849] binderfs_binder_device_create+0x17f/0xaf0
[ 102.877490][ T5849] binderfs_fill_super+0xa0e/0xe90
[ 102.882657][ T5849] get_tree_nodev+0xb8/0x150
[ 102.887288][ T5849] vfs_get_tree+0x8f/0x2b0
[ 102.891758][ T5849] do_new_mount+0x24a/0xa40
[ 102.896298][ T5849] __se_sys_mount+0x317/0x410
[ 102.901015][ T5849] do_syscall_64+0xf6/0x210
[ 102.905727][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.911643][ T5849]
[ 102.913985][ T5849] Freed by task 5843:
[ 102.918008][ T5849] kasan_save_track+0x3e/0x80
[ 102.922726][ T5849] kasan_save_free_info+0x46/0x50
[ 102.927785][ T5849] __kasan_slab_free+0x62/0x70
[ 102.932582][ T5849] kfree+0x193/0x440
[ 102.936503][ T5849] evict+0x501/0x9c0
[ 102.940438][ T5849] __dentry_kill+0x209/0x660
[ 102.945061][ T5849] shrink_kill+0xa9/0x2c0
[ 102.949432][ T5849] shrink_dentry_list+0x2e0/0x5e0
[ 102.954498][ T5849] shrink_dcache_parent+0xa1/0x2c0
[ 102.959653][ T5849] do_one_tree+0x23/0xe0
[ 102.963928][ T5849] shrink_dcache_for_umount+0xa0/0x170
[ 102.969431][ T5849] generic_shutdown_super+0x67/0x2c0
[ 102.974735][ T5849] kill_litter_super+0x76/0xb0
[ 102.979527][ T5849] binderfs_kill_super+0x44/0x90
[ 102.984581][ T5849] deactivate_locked_super+0xb9/0x130
[ 102.989973][ T5849] cleanup_mnt+0x425/0x4c0
[ 102.994522][ T5849] task_work_run+0x1d1/0x260
[ 102.999141][ T5849] do_exit+0x8d6/0x2550
[ 103.003329][ T5849] do_group_exit+0x21c/0x2d0
[ 103.008326][ T5849] get_signal+0x125e/0x1310
[ 103.012870][ T5849] arch_do_signal_or_restart+0x95/0x780
[ 103.018445][ T5849] syscall_exit_to_user_mode+0x8b/0x120
[ 103.024022][ T5849] do_syscall_64+0x103/0x210
[ 103.028643][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.034559][ T5849]
[ 103.036906][ T5849] The buggy address belongs to the object at ffff888034245c00
[ 103.036906][ T5849] which belongs to the cache kmalloc-512 of size 512
[ 103.051074][ T5849] The buggy address is located 8 bytes inside of
[ 103.051074][ T5849] freed 512-byte region [ffff888034245c00, ffff888034245e00)
[ 103.065237][ T5849]
[ 103.067561][ T5849] The buggy address belongs to the physical page:
[ 103.073993][ T5849] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34244
[ 103.082889][ T5849] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 103.091504][ T5849] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 103.099172][ T5849] page_type: f5(slab)
[ 103.103182][ T5849] raw: 00fff00000000040 ffff88801a041c80 ffffea0000d1b800 dead000000000002
[ 103.111870][ T5849] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 103.120466][ T5849] head: 00fff00000000040 ffff88801a041c80 ffffea0000d1b800 dead000000000002
[ 103.129240][ T5849] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 103.137920][ T5849] head: 00fff00000000002 ffffea0000d09101 00000000ffffffff 00000000ffffffff
[ 103.146590][ T5849] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 103.155270][ T5849] page dumped because: kasan: bad access detected
[ 103.161692][ T5849] page_owner tracks the page as allocated
[ 103.167509][ T5849] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5204, tgid 5204 (udevd), ts 42015420875, free_ts 41984296682
[ 103.188636][ T5849] post_alloc_hook+0x1d8/0x230
[ 103.193416][ T5849] get_page_from_freelist+0x21e0/0x22c0
[ 103.198977][ T5849] __alloc_frozen_pages_noprof+0x181/0x370
[ 103.204875][ T5849] alloc_pages_mpol+0x232/0x4a0
[ 103.209727][ T5849] allocate_slab+0x8a/0x3b0
[ 103.214260][ T5849] ___slab_alloc+0xbfc/0x1480
[ 103.219028][ T5849] __kmalloc_cache_noprof+0x296/0x3d0
[ 103.224399][ T5849] kernfs_fop_open+0x397/0xca0
[ 103.229159][ T5849] do_dentry_open+0xdf0/0x1970
[ 103.234014][ T5849] vfs_open+0x3b/0x340
[ 103.238088][ T5849] path_openat+0x2ee5/0x3830
[ 103.242670][ T5849] do_filp_open+0x1fa/0x410
[ 103.247163][ T5849] do_sys_openat2+0x121/0x1c0
[ 103.251857][ T5849] __x64_sys_openat+0x138/0x170
[ 103.256721][ T5849] do_syscall_64+0xf6/0x210
[ 103.261246][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.267165][ T5849] page last free pid 5199 tgid 5199 stack trace:
[ 103.273723][ T5849] __free_frozen_pages+0xb14/0xce0
[ 103.278874][ T5849] __put_partials+0x161/0x1c0
[ 103.283640][ T5849] put_cpu_partial+0x17c/0x250
[ 103.288427][ T5849] __slab_free+0x2f7/0x400
[ 103.292845][ T5849] qlist_free_all+0x9a/0x140
[ 103.297458][ T5849] kasan_quarantine_reduce+0x148/0x160
[ 103.302918][ T5849] __kasan_slab_alloc+0x22/0x80
[ 103.307777][ T5849] kmem_cache_alloc_noprof+0x1c1/0x3c0
[ 103.313259][ T5849] getname_flags+0xb8/0x540
[ 103.317788][ T5849] do_sys_openat2+0xbc/0x1c0
[ 103.322850][ T5849] __x64_sys_openat+0x138/0x170
[ 103.327730][ T5849] do_syscall_64+0xf6/0x210
[ 103.332244][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.338191][ T5849]
[ 103.340512][ T5849] Memory state around the buggy address:
[ 103.346247][ T5849] ffff888034245b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 103.354496][ T5849] ffff888034245b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 103.362568][ T5849] >ffff888034245c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.370635][ T5849] ^
[ 103.374974][ T5849] ffff888034245c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.383091][ T5849] ffff888034245d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.391167][ T5849] ==================================================================
[ 103.401196][ T5849] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.408553][ T5849] CPU: 0 UID: 0 PID: 5849 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00746-g836b313a14a3 #0 PREEMPT(full)
[ 103.420767][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
[ 103.431122][ T5849] Call Trace:
[ 103.434531][ T5849]
[ 103.437585][ T5849] dump_stack_lvl+0x99/0x250
[ 103.442409][ T5849] ? __asan_memcpy+0x40/0x70
[ 103.447307][ T5849] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.452655][ T5849] ? __pfx__printk+0x10/0x10
[ 103.457415][ T5849] panic+0x2db/0x790
[ 103.461447][ T5849] ? __pfx_preempt_schedule+0x10/0x10
[ 103.466876][ T5849] ? __pfx_panic+0x10/0x10
[ 103.471433][ T5849] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 103.477627][ T5849] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 103.485599][ T5849] ? binder_add_device+0x5f/0xa0
[ 103.490766][ T5849] check_panic_on_warn+0x89/0xb0
[ 103.495773][ T5849] ? binder_add_device+0x5f/0xa0
[ 103.500946][ T5849] end_report+0x78/0x160
[ 103.505346][ T5849] kasan_report+0x129/0x150
[ 103.509997][ T5849] ? binder_add_device+0x5f/0xa0
[ 103.514959][ T5849] binder_add_device+0x5f/0xa0
[ 103.519844][ T5849] binderfs_binder_device_create+0x8b7/0xaf0
[ 103.525863][ T5849] binderfs_fill_super+0xa0e/0xe90
[ 103.531019][ T5849] ? __pfx_binderfs_fill_super+0x10/0x10
[ 103.536688][ T5849] ? shrinker_register+0x16b/0x230
[ 103.541828][ T5849] ? sget_fc+0x962/0xa40
[ 103.546078][ T5849] ? __pfx_set_anon_super_fc+0x10/0x10
[ 103.551573][ T5849] ? __pfx_binderfs_fill_super+0x10/0x10
[ 103.557230][ T5849] get_tree_nodev+0xb8/0x150
[ 103.561840][ T5849] vfs_get_tree+0x8f/0x2b0
[ 103.566304][ T5849] do_new_mount+0x24a/0xa40
[ 103.570853][ T5849] __se_sys_mount+0x317/0x410
[ 103.575559][ T5849] ? __pfx___se_sys_mount+0x10/0x10
[ 103.580773][ T5849] ? do_syscall_64+0xba/0x210
[ 103.585464][ T5849] ? __x64_sys_mount+0x20/0xc0
[ 103.590245][ T5849] do_syscall_64+0xf6/0x210
[ 103.594777][ T5849] ? clear_bhb_loop+0x45/0xa0
[ 103.599462][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.605361][ T5849] RIP: 0033:0x7f978af9010a
[ 103.609795][ T5849] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 103.629470][ T5849] RSP: 002b:00007ffcd906bce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 103.637909][ T5849] RAX: ffffffffffffffda RBX: 00007f978b010e74 RCX: 00007f978af9010a
[ 103.646001][ T5849] RDX: 00007f978b0208cb RSI: 00007f978b010e74 RDI: 00007f978b0208cb
[ 103.654097][ T5849] RBP: 00007f978b0110bd R08: 0000000000000000 R09: 00000000000001ff
[ 103.662247][ T5849] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f978afec1a8
[ 103.670236][ T5849] R13: 00007f978afec180 R14: 0000000000000009 R15: 0000000000000000
[ 103.678226][ T5849]
[ 103.681526][ T5849] Kernel Offset: disabled
[ 103.685866][ T5849] Rebooting in 86400 seconds..