BUG: Bad page state in process jfsCommit  pfn:2ed37
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x2ed37
flags: 0xfff0000000820d(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff0000000820d dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff88802af499b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5192, tgid 401566671 (syz-executor874), ts 5192, free_ts 51421990046
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
 __alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
 alloc_pages_mpol+0x275/0x610 mm/mempolicy.c:2264
 folio_alloc+0x1e/0x40 mm/mempolicy.c:2342
 filemap_alloc_folio+0x3ba/0x490 mm/filemap.c:984
 do_read_cache_folio+0x1b6/0x540 mm/filemap.c:3711
 do_read_cache_page mm/filemap.c:3813 [inline]
 read_cache_page+0x5b/0x160 mm/filemap.c:3822
 read_mapping_page include/linux/pagemap.h:888 [inline]
 __get_metapage+0x997/0x1170 fs/jfs/jfs_metapage.c:620
 diRead+0x650/0xb00 fs/jfs/jfs_imap.c:364
 jfs_iget+0x88/0x4d0 fs/jfs/inode.c:35
 jfs_fill_super+0x6c8/0xd20 fs/jfs/super.c:580
 mount_bdev+0x1e3/0x2d0 fs/super.c:1658
 legacy_get_tree+0x109/0x220 fs/fs_context.c:662
 vfs_get_tree+0x8f/0x380 fs/super.c:1779
 do_new_mount fs/namespace.c:3352 [inline]
 path_mount+0x14e6/0x1f20 fs/namespace.c:3679
page last free pid 5189 tgid 5189 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 __folio_put_small mm/swap.c:119 [inline]
 __folio_put+0x166/0x290 mm/swap.c:142
 folio_put include/linux/mm.h:1508 [inline]
 put_page include/linux/mm.h:1580 [inline]
 anon_pipe_buf_release+0x3fa/0x4b0 fs/pipe.c:128
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x647/0x1400 fs/pipe.c:344
 call_read_iter include/linux/fs.h:2104 [inline]
 new_sync_read fs/read_write.c:395 [inline]
 vfs_read+0x9fd/0xb80 fs/read_write.c:476
 ksys_read+0x1f8/0x260 fs/read_write.c:619
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 2 PID: 136 Comm: jfsCommit Not tainted 6.9.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:114
 bad_page+0xb3/0x200 mm/page_alloc.c:515
 free_page_is_bad_report mm/page_alloc.c:958 [inline]
 free_page_is_bad mm/page_alloc.c:968 [inline]
 free_pages_prepare mm/page_alloc.c:1133 [inline]
 free_unref_page_prepare+0x54d/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 __folio_put_small mm/swap.c:119 [inline]
 __folio_put+0x166/0x290 mm/swap.c:142
 folio_put include/linux/mm.h:1508 [inline]
 put_page include/linux/mm.h:1580 [inline]
 _metapage_homeok fs/jfs/jfs_metapage.h:119 [inline]
 _metapage_homeok fs/jfs/jfs_metapage.h:116 [inline]
 txUnlock+0x6bb/0xd10 fs/jfs/jfs_txnmgr.c:932
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x730/0xb20 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x2ed37
flags: 0xfff0000000820d(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff0000000820d dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff88802af499b0 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5192, tgid 401566671 (syz-executor874), ts 5192, free_ts 51421990046
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
 __alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
 alloc_pages_mpol+0x275/0x610 mm/mempolicy.c:2264
 folio_alloc+0x1e/0x40 mm/mempolicy.c:2342
 filemap_alloc_folio+0x3ba/0x490 mm/filemap.c:984
 do_read_cache_folio+0x1b6/0x540 mm/filemap.c:3711
 do_read_cache_page mm/filemap.c:3813 [inline]
 read_cache_page+0x5b/0x160 mm/filemap.c:3822
 read_mapping_page include/linux/pagemap.h:888 [inline]
 __get_metapage+0x997/0x1170 fs/jfs/jfs_metapage.c:620
 diRead+0x650/0xb00 fs/jfs/jfs_imap.c:364
 jfs_iget+0x88/0x4d0 fs/jfs/inode.c:35
 jfs_fill_super+0x6c8/0xd20 fs/jfs/super.c:580
 mount_bdev+0x1e3/0x2d0 fs/super.c:1658
 legacy_get_tree+0x109/0x220 fs/fs_context.c:662
 vfs_get_tree+0x8f/0x380 fs/super.c:1779
 do_new_mount fs/namespace.c:3352 [inline]
 path_mount+0x14e6/0x1f20 fs/namespace.c:3679
page last free pid 5189 tgid 5189 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 __folio_put_small mm/swap.c:119 [inline]
 __folio_put+0x166/0x290 mm/swap.c:142
 folio_put include/linux/mm.h:1508 [inline]
 put_page include/linux/mm.h:1580 [inline]
 anon_pipe_buf_release+0x3fa/0x4b0 fs/pipe.c:128
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x647/0x1400 fs/pipe.c:344
 call_read_iter include/linux/fs.h:2104 [inline]
 new_sync_read fs/read_write.c:395 [inline]
 vfs_read+0x9fd/0xb80 fs/read_write.c:476
 ksys_read+0x1f8/0x260 fs/read_write.c:619
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1474!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 PID: 136 Comm: jfsCommit Tainted: G    B              6.9.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:folio_get include/linux/mm.h:1474 [inline]
RIP: 0010:folio_get include/linux/mm.h:1472 [inline]
RIP: 0010:get_page include/linux/mm.h:1480 [inline]
RIP: 0010:put_metapage+0x2da/0x340 fs/jfs/jfs_metapage.c:750
Code: 83 fe 49 8d 6f ff e9 66 fe ff ff e8 f0 98 de fe e9 d9 fd ff ff e8 c6 4c 83 fe 48 c7 c6 20 92 4a 8b 48 89 ef e8 87 1c c5 fe 90 <0f> 0b 4c 89 ef e8 fc 98 de fe e9 72 fd ff ff 4c 89 f7 e8 ef 98 de
RSP: 0018:ffffc90002f67d10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802af499b0 RCX: ffffffff816be7c9
RDX: ffff88801cf32440 RSI: ffffffff830a8039 RDI: 0000000000000000
RBP: ffffea0000bb4dc0 R08: 0000000000000000 R09: fffffbfff1f3eaba
R10: ffffffff8f9f55d7 R11: 535f7972746e6520 R12: ffffea0000bb4df4
R13: ffff88802af49a40 R14: ffff88802af499d8 R15: 000000000000007f
FS:  0000000000000000(0000) GS:ffff88806b400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f57d27e4866 CR3: 000000000d57a000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 txUnlock+0x46d/0xd10 fs/jfs/jfs_txnmgr.c:947
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x730/0xb20 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_get include/linux/mm.h:1474 [inline]
RIP: 0010:folio_get include/linux/mm.h:1472 [inline]
RIP: 0010:get_page include/linux/mm.h:1480 [inline]
RIP: 0010:put_metapage+0x2da/0x340 fs/jfs/jfs_metapage.c:750
Code: 83 fe 49 8d 6f ff e9 66 fe ff ff e8 f0 98 de fe e9 d9 fd ff ff e8 c6 4c 83 fe 48 c7 c6 20 92 4a 8b 48 89 ef e8 87 1c c5 fe 90 <0f> 0b 4c 89 ef e8 fc 98 de fe e9 72 fd ff ff 4c 89 f7 e8 ef 98 de
RSP: 0018:ffffc90002f67d10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802af499b0 RCX: ffffffff816be7c9
RDX: ffff88801cf32440 RSI: ffffffff830a8039 RDI: 0000000000000000
RBP: ffffea0000bb4dc0 R08: 0000000000000000 R09: fffffbfff1f3eaba
R10: ffffffff8f9f55d7 R11: 535f7972746e6520 R12: ffffea0000bb4df4
R13: ffff88802af49a40 R14: ffff88802af499d8 R15: 000000000000007f
FS:  0000000000000000(0000) GS:ffff88806b400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f57d27e4866 CR3: 000000000d57a000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400