syzbot

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54400
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 ffffea000154aa08 ffffea0001510048 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x153c4a(GFP_NOFS|__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_WRITE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5319, tgid 5317 (syz.0.0), ts 76113780535, free_ts 76568764333
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
 folio_alloc_mpol_noprof mm/mempolicy.c:2438 [inline]
 vma_alloc_folio_noprof+0xe4/0x200 mm/mempolicy.c:2473
 folio_prealloc+0x30/0x180 mm/memory.c:-1
 wp_page_copy mm/memory.c:3569 [inline]
 do_wp_page+0x1231/0x5800 mm/memory.c:4030
 handle_pte_fault mm/memory.c:6105 [inline]
 __handle_mm_fault+0x1144/0x5620 mm/memory.c:6232
 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6401
 do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
page last free pid 5319 tgid 5317 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 free_unref_folios+0xc66/0x14d0 mm/page_alloc.c:2763
 folios_put_refs+0x559/0x640 mm/swap.c:992
 folio_batch_release include/linux/pagevec.h:101 [inline]
 truncate_inode_pages_range+0x8f7/0xda0 mm/truncate.c:440
 xfs_flush_unmap_range+0xdf/0xf0 fs/xfs/xfs_bmap_util.c:836
 xfs_reflink_remap_prep+0x57f/0x720 fs/xfs/xfs_reflink.c:1717
 xfs_file_remap_range+0x235/0x780 fs/xfs/xfs_file.c:1506
 vfs_copy_file_range+0xd53/0x1310 fs/read_write.c:1591
 __do_sys_copy_file_range fs/read_write.c:1677 [inline]
 __se_sys_copy_file_range+0x2fb/0x470 fs/read_write.c:1644
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1034!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 27 Comm: kworker/u4:2 Not tainted 6.15.0-syzkaller-11796-g5abc7438f1e9 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: loop0 loop_workfn
RIP: 0010:put_page_testzero include/linux/mm.h:1034 [inline]
RIP: 0010:folio_put_testzero include/linux/mm.h:1040 [inline]
RIP: 0010:folio_put include/linux/mm.h:1355 [inline]
RIP: 0010:folio_end_writeback+0x530/0x560 mm/filemap.c:1665
Code: d0 c8 ff 48 89 df 48 c7 c6 80 39 94 8b e8 48 6a 10 00 90 0f 0b e8 40 d0 c8 ff 48 89 df 48 c7 c6 20 38 94 8b e8 31 6a 10 00 90 <0f> 0b e8 29 d0 c8 ff 48 89 df 48 c7 c6 60 35 94 8b e8 1a 6a 10 00
RSP: 0018:ffffc900004e7448 EFLAGS: 00010246
RAX: 498a4c88c4c64700 RBX: ffffea0001510000 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8d979f2e RDI: 00000000ffffffff
RBP: 0000000000000000 R08: ffffffff8fa0f5f7 R09: 1ffffffff1f41ebe
R10: dffffc0000000000 R11: fffffbfff1f41ebf R12: ffff88805ffdb3e8
R13: dffffc0000000000 R14: ffffea0001510034 R15: ffff88805ffd6400
FS:  0000000000000000(0000) GS:ffff88808d25c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558c7176f168 CR3: 0000000051b9b000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 iomap_finish_folio_write fs/iomap/buffered-io.c:1547 [inline]
 iomap_finish_ioend_buffered+0x406/0x630 fs/iomap/buffered-io.c:1574
 blk_update_request+0x5eb/0xe70 block/blk-mq.c:987
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149
 lo_rw_aio_do_completion drivers/block/loop.c:317 [inline]
 lo_rw_aio_complete drivers/block/loop.c:325 [inline]
 lo_rw_aio+0xda6/0xf30 drivers/block/loop.c:398
 do_req_filebacked drivers/block/loop.c:-1 [inline]
 loop_handle_cmd drivers/block/loop.c:1886 [inline]
 loop_process_work+0x810/0xf40 drivers/block/loop.c:1921
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:1034 [inline]
RIP: 0010:folio_put_testzero include/linux/mm.h:1040 [inline]
RIP: 0010:folio_put include/linux/mm.h:1355 [inline]
RIP: 0010:folio_end_writeback+0x530/0x560 mm/filemap.c:1665
Code: d0 c8 ff 48 89 df 48 c7 c6 80 39 94 8b e8 48 6a 10 00 90 0f 0b e8 40 d0 c8 ff 48 89 df 48 c7 c6 20 38 94 8b e8 31 6a 10 00 90 <0f> 0b e8 29 d0 c8 ff 48 89 df 48 c7 c6 60 35 94 8b e8 1a 6a 10 00
RSP: 0018:ffffc900004e7448 EFLAGS: 00010246
RAX: 498a4c88c4c64700 RBX: ffffea0001510000 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8d979f2e RDI: 00000000ffffffff
RBP: 0000000000000000 R08: ffffffff8fa0f5f7 R09: 1ffffffff1f41ebe
R10: dffffc0000000000 R11: fffffbfff1f41ebf R12: ffff88805ffdb3e8
R13: dffffc0000000000 R14: ffffea0001510034 R15: ffff88805ffd6400
FS:  0000000000000000(0000) GS:ffff88808d25c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558c7176f168 CR3: 0000000012334000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400