last executing test programs: 1.739343082s ago: executing program 0 (id=370): geteuid() 1.706639715s ago: executing program 0 (id=374): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/target_ids', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/target_ids', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/target_ids', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/target_ids', 0x800, 0x0) 1.676883945s ago: executing program 0 (id=380): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/load', 0x2, 0x0) 1.62406523s ago: executing program 0 (id=383): tkill(0x0, 0x0) 1.623288195s ago: executing program 0 (id=387): time(&(0x7f0000000000)) 1.595482721s ago: executing program 0 (id=391): pause() 261.161835ms ago: executing program 1 (id=543): socket$pppl2tp(0x18, 0x1, 0x1) 215.929577ms ago: executing program 1 (id=545): socket$inet_tcp(0x2, 0x1, 0x0) 215.296328ms ago: executing program 4 (id=547): socket$igmp(0x2, 0x3, 0x2) 214.760908ms ago: executing program 1 (id=549): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/socket/zygote', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/socket/zygote', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/socket/zygote', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/socket/zygote', 0x800, 0x0) 214.659313ms ago: executing program 2 (id=550): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max', 0x2, 0x0) 192.09129ms ago: executing program 1 (id=551): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0', 0x800, 0x0) 191.893826ms ago: executing program 2 (id=552): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 189.994259ms ago: executing program 4 (id=553): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer', 0x800, 0x0) 127.457314ms ago: executing program 2 (id=555): socket$nl_sock_diag(0x10, 0x3, 0x4) 127.122535ms ago: executing program 1 (id=557): socket$rxrpc(0x21, 0x2, 0x0) 127.019879ms ago: executing program 3 (id=558): pwritev2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 126.948023ms ago: executing program 2 (id=559): shmdt(0x0) 126.705373ms ago: executing program 1 (id=560): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx', 0x800, 0x0) 126.605556ms ago: executing program 4 (id=561): epoll_pwait2(0xffffffffffffffff, &(0x7f0000000000), 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0) 71.79771ms ago: executing program 3 (id=562): iopl(0x0) 71.717094ms ago: executing program 2 (id=563): mlock2(0x0, 0x0, 0x0) 71.6624ms ago: executing program 3 (id=564): utime(&(0x7f0000000000), &(0x7f0000000000)) 71.554266ms ago: executing program 2 (id=565): rt_sigreturn() 71.196004ms ago: executing program 3 (id=566): readlinkat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 71.104609ms ago: executing program 4 (id=567): eventfd2(0x0, 0x0) 64.839167ms ago: executing program 3 (id=568): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create', 0x2, 0x0) 57.976049ms ago: executing program 4 (id=569): madvise(0x0, 0x0, 0x0) 117.594µs ago: executing program 4 (id=570): lchown(&(0x7f0000000000), 0x0, 0x0) 0s ago: executing program 3 (id=571): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/access', 0x2, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.95' (ED25519) to the list of known hosts. [ 59.619263][ T5825] cgroup: Unknown subsys name 'net' [ 59.747140][ T5825] cgroup: Unknown subsys name 'cpuset' [ 59.755260][ T5825] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 61.127452][ T5825] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.728235][ T5964] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 64.620297][ T6112] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 66.066540][ T6294] mmap: syz.2.444 (6294) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 67.581304][ T6427] ================================================================== [ 67.581340][ T6427] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 [ 67.581400][ T6427] Write of size 8 at addr ffff88802ad92408 by task syz-executor/6427 [ 67.581424][ T6427] [ 67.581456][ T6427] CPU: 0 UID: 0 PID: 6427 Comm: syz-executor Not tainted 6.13.0-next-20250121-syzkaller #0 [ 67.581474][ T6427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 67.581484][ T6427] Call Trace: [ 67.581490][ T6427] [ 67.581497][ T6427] dump_stack_lvl+0x241/0x360 [ 67.581517][ T6427] ? __pfx_dump_stack_lvl+0x10/0x10 [ 67.581534][ T6427] ? __pfx__printk+0x10/0x10 [ 67.581550][ T6427] ? _printk+0xd5/0x120 [ 67.581564][ T6427] ? __virt_addr_valid+0x183/0x530 [ 67.581587][ T6427] ? __virt_addr_valid+0x183/0x530 [ 67.581610][ T6427] print_report+0x169/0x550 [ 67.581633][ T6427] ? __virt_addr_valid+0x183/0x530 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 67.581655][ T6427] ? __virt_addr_valid+0x183/0x530 [ 67.581676][ T6427] ? __virt_addr_valid+0x45f/0x530 [ 67.581698][ T6427] ? __phys_addr+0xba/0x170 [ 67.581720][ T6427] ? binder_add_device+0x5f/0xa0 [ 67.581741][ T6427] kasan_report+0x143/0x180 [ 67.581764][ T6427] ? binder_add_device+0x5f/0xa0 [ 67.581789][ T6427] binder_add_device+0x5f/0xa0 [ 67.581811][ T6427] binderfs_binder_device_create+0x7bf/0x9c0 [ 67.581836][ T6427] binderfs_fill_super+0x944/0xd90 [ 67.581871][ T6427] ? __pfx_binderfs_fill_super+0x10/0x10 [ 67.581901][ T6427] ? shrinker_register+0x160/0x230 [ 67.581923][ T6427] ? sget_fc+0x909/0x9c0 [ 67.581942][ T6427] ? __pfx_set_anon_super_fc+0x10/0x10 [ 67.581962][ T6427] ? __pfx_binderfs_fill_super+0x10/0x10 [ 67.581983][ T6427] get_tree_nodev+0xb7/0x140 [ 67.582004][ T6427] vfs_get_tree+0x90/0x2b0 [ 67.582026][ T6427] do_new_mount+0x2be/0xb40 [ 67.582044][ T6427] ? __pfx_do_new_mount+0x10/0x10 [ 67.582064][ T6427] __se_sys_mount+0x2d6/0x3c0 [ 67.582080][ T6427] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 67.582102][ T6427] ? __pfx___se_sys_mount+0x10/0x10 [ 67.582118][ T6427] ? exc_page_fault+0x590/0x8b0 [ 67.582142][ T6427] ? __x64_sys_mount+0x20/0xc0 [ 67.582158][ T6427] do_syscall_64+0xf3/0x230 [ 67.582175][ T6427] ? clear_bhb_loop+0x35/0x90 [ 67.582197][ T6427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.582223][ T6427] RIP: 0033:0x7effb57874ca [ 67.582243][ T6427] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 67.582255][ T6427] RSP: 002b:00007ffefeb90768 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 67.582274][ T6427] RAX: ffffffffffffffda RBX: 00007effb5801ecb RCX: 00007effb57874ca [ 67.582286][ T6427] RDX: 00007effb580ec27 RSI: 00007effb5801ecb RDI: 00007effb580ec27 [ 67.582298][ T6427] RBP: 00007ffefeb907e0 R08: 0000000000000000 R09: 0000000000000000 [ 67.582308][ T6427] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffefeb907e0 [ 67.582318][ T6427] R13: 00007ffefeb907e8 R14: 0000000000000009 R15: 0000000000000000 [ 67.582334][ T6427] [ 67.582340][ T6427] [ 67.582666][ T6427] Allocated by task 5836: [ 67.582685][ T6427] kasan_sa ** replaying previous printk message ** [ 67.582685][ T6427] kasan_save_track+0x3f/0x80 [ 67.582716][ T6427] __kasan_kmalloc+0x98/0xb0 [ 67.582746][ T6427] __kmalloc_cache_noprof+0x243/0x390 [ 67.582773][ T6427] binderfs_binder_device_create+0x16c/0x9c0 [ 67.582803][ T6427] binderfs_fill_super+0x944/0xd90 [ 67.582833][ T6427] get_tree_nodev+0xb7/0x140 [ 67.582867][ T6427] vfs_get_tree+0x90/0x2b0 [ 67.582897][ T6427] do_new_mount+0x2be/0xb40 [ 67.582920][ T6427] __se_sys_mount+0x2d6/0x3c0 [ 67.582944][ T6427] do_syscall_64+0xf3/0x230 [ 67.582969][ T6427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.582999][ T6427] [ 67.583013][ T6427] Freed by task 5836: [ 67.583030][ T6427] kasan_save_track+0x3f/0x80 [ 67.583059][ T6427] kasan_save_free_info+0x40/0x50 [ 67.583086][ T6427] __kasan_slab_free+0x59/0x70 [ 67.583116][ T6427] kfree+0x196/0x430 [ 67.583139][ T6427] evict+0x4e8/0x9a0 [ 67.583175][ T6427] __dentry_kill+0x20d/0x630 [ 67.583200][ T6427] shrink_kill+0xa9/0x2c0 [ 67.583225][ T6427] shrink_dentry_list+0x2c0/0x5b0 [ 67.583251][ T6427] shrink_dcache_parent+0xcb/0x3b0 [ 67.583278][ T6427] do_one_tree+0x23/0xe0 [ 67.583304][ T6427] shrink_dcache_for_umount+0xb4/0x180 [ 67.583331][ T6427] generic_shutdown_super+0x6a/0x2d0 [ 67.583359][ T6427] kill_litter_super+0x76/0xb0 [ 67.583387][ T6427] binderfs_kill_super+0x44/0x90 [ 67.583415][ T6427] deactivate_locked_super+0xc4/0x130 [ 67.583442][ T6427] cleanup_mnt+0x41f/0x4b0 [ 67.583469][ T6427] task_work_run+0x24f/0x310 [ 67.583501][ T6427] do_exit+0xa2a/0x28e0 [ 67.583529][ T6427] do_group_exit+0x207/0x2c0 [ 67.583557][ T6427] get_signal+0x16b2/0x1750 [ 67.583582][ T6427] arch_do_signal_or_restart+0x96/0x860 [ 67.583610][ T6427] syscall_exit_to_user_mode+0xce/0x340 [ 67.583635][ T6427] do_syscall_64+0x100/0x230 [ 67.583659][ T6427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.583689][ T6427] [ 67.583703][ T6427] The buggy address belongs to the object at ffff88802ad92400 [ 67.583703][ T6427] which belongs to the cache kmalloc-512 of size 512 [ 67.583727][ T6427] The buggy address is located 8 bytes inside of [ 67.583727][ T6427] freed 512-byte region [ffff88802ad92400, ffff88802ad92600) [ 67.583753][ T6427] [ 67.583767][ T6427] The buggy address belongs to the physical page: [ 67.583784][ T6427] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ad90 [ 67.583816][ T6427] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 67.583839][ T6427] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 67.583877][ T6427] page_type: f5(slab) [ 67.583899][ T6427] raw: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001 [ 67.583919][ T6427] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 67.583941][ T6427] head: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001 [ 67.583963][ T6427] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 67.583986][ T6427] head: 00fff00000000002 ffffea0000ab6401 ffffffffffffffff 0000000000000000 [ 67.584007][ T6427] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 67.584025][ T6427] page dumped because: kasan: bad access detected [ 67.584046][ T6427] page_owner tracks the page as allocated [ 67.584060][ T6427] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5224, tgid 5224 (udevd), ts 21352125690, free_ts 21343115571 [ 67.584098][ T6427] post_alloc_hook+0x1f4/0x240 [ 67.584126][ T6427] get_page_from_freelist+0x365c/0x37a0 [ 67.584156][ T6427] __alloc_frozen_pages_noprof+0x292/0x710 [ 67.584186][ T6427] alloc_pages_mpol+0x311/0x660 [ 67.584210][ T6427] allocate_slab+0x8f/0x3a0 [ 67.584237][ T6427] ___slab_alloc+0xc27/0x14a0 [ 67.584263][ T6427] __slab_alloc+0x58/0xa0 [ 67.584290][ T6427] __kmalloc_cache_noprof+0x27b/0x390 [ 67.584313][ T6427] kernfs_fop_open+0x3e0/0xd10 [ 67.584339][ T6427] do_dentry_open+0xdec/0x1960 [ 67.584361][ T6427] vfs_open+0x3b/0x370 [ 67.584383][ T6427] path_openat+0x2c81/0x3590 [ 67.584410][ T6427] do_filp_open+0x27f/0x4e0 [ 67.584436][ T6427] do_sys_openat2+0x13e/0x1d0 [ 67.584458][ T6427] __x64_sys_openat+0x247/0x2a0 [ 67.584481][ T6427] do_syscall_64+0xf3/0x230 [ 67.584505][ T6427] page last free pid 5225 tgid 5225 stack trace: [ 67.584524][ T6427] free_frozen_pages+0xe0d/0x10e0 [ 67.584551][ T6427] __slab_free+0x2c2/0x380 [ 67.584579][ T6427] qlist_free_all+0x9a/0x140 [ 67.584607][ T6427] kasan_quarantine_reduce+0x14f/0x170 [ 67.584634][ T6427] __kasan_slab_alloc+0x23/0x80 [ 67.584663][ T6427] kmem_cache_alloc_noprof+0x1d9/0x380 [ 67.584686][ T6427] getname_flags+0xb7/0x540 [ 67.584706][ T6427] do_readlinkat+0xd8/0x3a0 [ 67.584731][ T6427] __x64_sys_readlink+0x7f/0x90 [ 67.584755][ T6427] do_syscall_64+0xf3/0x230 [ 67.584778][ T6427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.584806][ T6427] [ 67.584818][ T6427] Memory state around the buggy address: [ 67.584836][ T6427] ffff88802ad92300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.584855][ T6427] ffff88802ad92380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.584883][ T6427] >ffff88802ad92400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.584901][ T6427] ^ [ 67.584920][ T6427] ffff88802ad92480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.584941][ T6427] ffff88802ad92500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.584959][ T6427] ================================================================== [ 67.899681][ T6427] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.436816][ T6427] CPU: 1 UID: 0 PID: 6427 Comm: syz-executor Not tainted 6.13.0-next-20250121-syzkaller #0 [ 68.446805][ T6427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 68.456868][ T6427] Call Trace: [ 68.460147][ T6427] [ 68.463078][ T6427] dump_stack_lvl+0x241/0x360 [ 68.467751][ T6427] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.473029][ T6427] ? __pfx__printk+0x10/0x10 [ 68.477638][ T6427] ? preempt_schedule+0xe1/0xf0 [ 68.482495][ T6427] ? vscnprintf+0x5d/0x90 [ 68.486821][ T6427] panic+0x349/0x880 [ 68.490712][ T6427] ? check_panic_on_warn+0x21/0xb0 [ 68.495851][ T6427] ? __pfx_panic+0x10/0x10 [ 68.500274][ T6427] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 68.506251][ T6427] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 68.512573][ T6427] ? print_report+0x502/0x550 [ 68.517258][ T6427] check_panic_on_warn+0x86/0xb0 [ 68.522193][ T6427] ? binder_add_device+0x5f/0xa0 [ 68.527215][ T6427] end_report+0x77/0x160 [ 68.531545][ T6427] kasan_report+0x154/0x180 [ 68.536047][ T6427] ? binder_add_device+0x5f/0xa0 [ 68.540985][ T6427] binder_add_device+0x5f/0xa0 [ 68.545754][ T6427] binderfs_binder_device_create+0x7bf/0x9c0 [ 68.551740][ T6427] binderfs_fill_super+0x944/0xd90 [ 68.556852][ T6427] ? __pfx_binderfs_fill_super+0x10/0x10 [ 68.562487][ T6427] ? shrinker_register+0x160/0x230 [ 68.567687][ T6427] ? sget_fc+0x909/0x9c0 [ 68.571923][ T6427] ? __pfx_set_anon_super_fc+0x10/0x10 [ 68.577469][ T6427] ? __pfx_binderfs_fill_super+0x10/0x10 [ 68.583115][ T6427] get_tree_nodev+0xb7/0x140 [ 68.587705][ T6427] vfs_get_tree+0x90/0x2b0 [ 68.592126][ T6427] do_new_mount+0x2be/0xb40 [ 68.596748][ T6427] ? __pfx_do_new_mount+0x10/0x10 [ 68.601766][ T6427] __se_sys_mount+0x2d6/0x3c0 [ 68.606437][ T6427] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 68.612412][ T6427] ? __pfx___se_sys_mount+0x10/0x10 [ 68.617597][ T6427] ? exc_page_fault+0x590/0x8b0 [ 68.622445][ T6427] ? __x64_sys_mount+0x20/0xc0 [ 68.627288][ T6427] do_syscall_64+0xf3/0x230 [ 68.631788][ T6427] ? clear_bhb_loop+0x35/0x90 [ 68.636462][ T6427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.642349][ T6427] RIP: 0033:0x7effb57874ca [ 68.646841][ T6427] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.666695][ T6427] RSP: 002b:00007ffefeb90768 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 68.675099][ T6427] RAX: ffffffffffffffda RBX: 00007effb5801ecb RCX: 00007effb57874ca [ 68.683150][ T6427] RDX: 00007effb580ec27 RSI: 00007effb5801ecb RDI: 00007effb580ec27 [ 68.691127][ T6427] RBP: 00007ffefeb907e0 R08: 0000000000000000 R09: 0000000000000000 [ 68.699128][ T6427] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffefeb907e0 [ 68.707179][ T6427] R13: 00007ffefeb907e8 R14: 0000000000000009 R15: 0000000000000000 [ 68.715148][ T6427] [ 69.846475][ T6427] Shutting down cpus with NMI [ 69.851636][ T6427] Kernel Offset: disabled [ 69.855948][ T6427] Rebooting in 86400 seconds..