------------[ cut here ]------------
page_counter underflow: -512 nr_pages=512
WARNING: mm/page_counter.c:60 at page_counter_cancel mm/page_counter.c:60 [inline], CPU#2: syz.3.2707/14164
WARNING: mm/page_counter.c:60 at page_counter_uncharge+0x140/0x1b0 mm/page_counter.c:184, CPU#2: syz.3.2707/14164
Modules linked in:
CPU: 2 UID: 0 PID: 14164 Comm: syz.3.2707 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:page_counter_cancel mm/page_counter.c:60 [inline]
RIP: 0010:page_counter_uncharge+0x147/0x1b0 mm/page_counter.c:184
Code: 2f b8 8a ff 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc e8 17 b8 8a ff 48 8d 3d 30 0e 60 0e 48 8b 14 24 48 89 ee <67> 48 0f b9 3a be 08 00 00 00 48 89 df e8 d7 b3 f8 ff 48 89 da 48
RSP: 0018:ffffc9000ddef3a0 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffff88803693f380 RCX: ffffffff827e8c38
RDX: 0000000000000200 RSI: fffffffffffffe00 RDI: ffffffff90de9b00
RBP: fffffffffffffe00 R08: 0000000000000007 R09: 0000000000000000
R10: fffffffffffffe00 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000200 R14: 0000000000000001 R15: 00000000000000f4
FS: 0000000000000000(0000) GS:ffff8880d655f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb2f22beff8 CR3: 000000000e596000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__hugetlb_cgroup_uncharge_folio.part.0+0x238/0x620 mm/hugetlb_cgroup.c:354
__hugetlb_cgroup_uncharge_folio include/linux/hugetlb_cgroup.h:105 [inline]
hugetlb_cgroup_uncharge_folio_rsvd+0x2e/0x40 mm/hugetlb_cgroup.c:382
free_huge_folio+0x6cc/0xce0 mm/hugetlb.c:1729
folios_put_refs+0x6a6/0xa90 mm/swap.c:989
folio_batch_release include/linux/folio_batch.h:101 [inline]
remove_inode_hugepages+0x682/0x1090 fs/hugetlbfs/inode.c:582
hugetlbfs_evict_inode+0x8b/0x250 fs/hugetlbfs/inode.c:597
evict+0x3c2/0xad0 fs/inode.c:828
iput_final fs/inode.c:2022 [inline]
iput.part.0+0x989/0x1050 fs/inode.c:2071
iput+0x35/0x40 fs/inode.c:2037
dentry_unlink_inode+0x284/0x470 fs/dcache.c:479
dentry_kill+0x25d/0xc20 fs/dcache.c:826
finish_dput fs/dcache.c:1001 [inline]
dput.part.0+0xd7/0x240 fs/dcache.c:1042
dput+0x1f/0x30 fs/dcache.c:1037
__fput+0x519/0xb50 fs/file_table.c:520
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x951/0x2ae0 kernel/exit.c:1004
do_group_exit+0xd5/0x2a0 kernel/exit.c:1147
get_signal+0x1ec7/0x21e0 kernel/signal.c:3038
arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a2eb9ce59
Code: Unable to access opcode bytes at 0x7f7a2eb9ce2f.
RSP: 002b:00007f7a2f9a40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f7a2ee15fa8 RCX: 00007f7a2eb9ce59
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7a2ee15fa8
RBP: 00007f7a2ee15fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7a2ee16038 R14: 00007ffc6d42d140 R15: 00007ffc6d42d228
</TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 8a ff mov %bh,%bh
2: 48 83 c4 10 add $0x10,%rsp
6: 5b pop %rbx
7: 5d pop %rbp
8: 41 5c pop %r12
a: 41 5d pop %r13
c: 41 5e pop %r14
e: 41 5f pop %r15
10: c3 ret
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: e8 17 b8 8a ff call 0xff8ab831
1a: 48 8d 3d 30 0e 60 0e lea 0xe600e30(%rip),%rdi # 0xe600e51
21: 48 8b 14 24 mov (%rsp),%rdx
25: 48 89 ee mov %rbp,%rsi
* 28: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2d: be 08 00 00 00 mov $0x8,%esi
32: 48 89 df mov %rbx,%rdi
35: e8 d7 b3 f8 ff call 0xfff8b411
3a: 48 89 da mov %rbx,%rdx
3d: 48 rex.W