syzbot

raw: 0000000000020003 0000000000000000 00000002ffffffff ffff0000cd9e0000
page dumped because: VM_BUG_ON_FOLIO(!folio_test_uptodate(folio))
------------[ cut here ]------------
kernel BUG at mm/swap_state.c:184!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 8950 Comm: syz-executor.3 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : add_to_swap+0x1b4/0x1b8 mm/swap_state.c:184
lr : add_to_swap+0x1b4/0x1b8 mm/swap_state.c:184
sp : ffff80009a215ae0
x29: ffff80009a215ae0 x28: fffffdffc3d59048 x27: 1fffffbff87ab208
x26: fffffdffc3d59058 x25: 0000000000000004 x24: 05ffc00000482011
x23: 1fffffbff87ab208 x22: 1fffffbff87ab209 x21: dfff800000000000
x20: 05ffc00000482011 x19: fffffdffc3d59040 x18: 1fffe000367b8996
x17: ffff80008eead000 x16: ffff800080333944 x15: 0000000000000001
x14: 1fffe000367bb590 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000040000 x10: 000000000003ffff x9 : 53f62b7bc0969300
x8 : 53f62b7bc0969300 x7 : ffff8000802aa2c0 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000100000000 x0 : 0000000000000041
Call trace:
 add_to_swap+0x1b4/0x1b8 mm/swap_state.c:184
 shrink_folio_list+0x1f90/0x4d7c mm/vmscan.c:1217
 shrink_inactive_list mm/vmscan.c:1926 [inline]
 shrink_list mm/vmscan.c:2163 [inline]
 shrink_lruvec+0x1164/0x26a0 mm/vmscan.c:5687
 shrink_node_memcgs mm/vmscan.c:5873 [inline]
 shrink_node+0xef4/0x2740 mm/vmscan.c:5908
 shrink_zones mm/vmscan.c:6152 [inline]
 do_try_to_free_pages+0x5a8/0x1660 mm/vmscan.c:6214
 try_to_free_mem_cgroup_pages+0x3c8/0xc3c mm/vmscan.c:6529
 try_charge_memcg+0x4a4/0x148c mm/memcontrol.c:2783
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 __mem_cgroup_charge+0xa8/0x148 mm/memcontrol.c:7299
 mem_cgroup_charge include/linux/memcontrol.h:691 [inline]
 shmem_alloc_and_add_folio+0x3ac/0xbcc mm/shmem.c:1677
 shmem_get_folio_gfp+0x6dc/0x1624 mm/shmem.c:2055
 shmem_read_folio_gfp+0xd4/0x160 mm/shmem.c:4960
 drm_gem_get_pages+0x1c0/0x8b4 drivers/gpu/drm/drm_gem.c:568
 drm_gem_shmem_get_pages drivers/gpu/drm/drm_gem_shmem_helper.c:178 [inline]
 drm_gem_shmem_vmap+0x364/0x778 drivers/gpu/drm/drm_gem_shmem_helper.c:334
 drm_gem_shmem_object_vmap+0x28/0x38 include/drm/drm_gem_shmem_helper.h:226
 drm_gem_vmap drivers/gpu/drm/drm_gem.c:1187 [inline]
 drm_gem_vmap_unlocked+0x104/0x1d8 drivers/gpu/drm/drm_gem.c:1217
 drm_gem_fb_vmap+0xa8/0x710 drivers/gpu/drm/drm_gem_framebuffer_helper.c:365
 vkms_prepare_fb+0x90/0xac drivers/gpu/drm/vkms/vkms_plane.c:176
 drm_atomic_helper_prepare_planes+0x27c/0x990 drivers/gpu/drm/drm_atomic_helper.c:2600
 drm_atomic_helper_commit+0x170/0x8d4 drivers/gpu/drm/drm_atomic_helper.c:2028
 drm_atomic_commit+0x274/0x2d0 drivers/gpu/drm/drm_atomic.c:1514
 drm_atomic_helper_update_plane+0x210/0x3ac drivers/gpu/drm/drm_atomic_helper.c:3186
 __setplane_atomic drivers/gpu/drm/drm_plane.c:1047 [inline]
 drm_mode_cursor_universal drivers/gpu/drm/drm_plane.c:1202 [inline]
 drm_mode_cursor_common+0xb0c/0x121c drivers/gpu/drm/drm_plane.c:1261
 drm_mode_cursor_ioctl+0xd0/0x14c drivers/gpu/drm/drm_plane.c:1311
 drm_ioctl_kernel+0x26c/0x368 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x5e4/0xae4 drivers/gpu/drm/drm_ioctl.c:841
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl fs/ioctl.c:890 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:890
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: d00536e1 91288021 aa1303e0 97fc2703 (d4210000) 
---[ end trace 0000000000000000 ]---