BUG: Bad page state (8)

BUG: Bad page state (8)
Status: upstream: reported on 2021/02/01 10:07
Reported-by: syzbot+97ef6376738cb5104a71@syzkaller.appspotmail.com
Fix commit: mm-filemap-add-filemap_range_uptodate-fix
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 176d, last: 171d

similar bugs (9):
Kernel	Title	Repro	Count	Last	Reported	Patched	Status
upstream	BUG: Bad page state (3)	C	3	1292d	1299d	4/22	fixed on 2018/02/02 04:39
upstream	BUG: Bad page state (5)	C	171	877d	890d	0/22	closed as invalid on 2019/02/27 20:53
upstream	BUG: Bad page state (7)		3	327d	384d	0/22	auto-closed as invalid on 2020/12/28 02:44
android-49	BUG: Bad page state		3	659d	683d	0/3	auto-closed as invalid on 2020/01/30 18:48
android-54	BUG: Bad page state	C	9	480d	511d	0/1	upstream: reported C repro on 2020/02/28 01:20
upstream	BUG: Bad page state (2)		1	1334d	1330d	0/22	closed as invalid on 2017/12/06 12:57
upstream	BUG: Bad page state (4)		1	1096d	1096d	0/22	closed as invalid on 2018/09/05 12:51
upstream	BUG: Bad page state (6)	C	2	876d	876d	0/22	closed as invalid on 2019/03/01 18:38
upstream	BUG: Bad page state	C	2	1437d	1438d	3/22	fixed on 2017/10/24 06:54

Sample crash report:

BUG: Bad page state in process syz-executor.4  pfn:337ac
page:000000007dbd65ab refcount:0 mapcount:0 mapping:0000000000000000 index:0x10 pfn:0x337ac
flags: 0xfff00000020005(locked|uptodate|mappedtodisk)
raw: 00fff00000020005 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000010 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
Modules linked in:
CPU: 1 PID: 11804 Comm: syz-executor.4 Not tainted 5.11.0-rc6-next-20210201-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 bad_page.cold+0x9c/0xbd mm/page_alloc.c:643
 check_free_page_bad mm/page_alloc.c:1139 [inline]
 check_free_page mm/page_alloc.c:1149 [inline]
 free_pages_prepare mm/page_alloc.c:1265 [inline]
 free_pcp_prepare+0x300/0x400 mm/page_alloc.c:1306
 free_unref_page_prepare mm/page_alloc.c:3201 [inline]
 free_unref_page+0x12/0x1b0 mm/page_alloc.c:3249
 __put_single_page mm/swap.c:97 [inline]
 __put_page+0xe1/0x3e0 mm/swap.c:128
 put_page include/linux/mm.h:1216 [inline]
 filemap_update_page mm/filemap.c:2326 [inline]
 filemap_get_pages+0x1312/0x1920 mm/filemap.c:2415
 filemap_read+0x2c5/0xe40 mm/filemap.c:2475
 generic_file_read_iter+0x397/0x4f0 mm/filemap.c:2626
 ext4_file_read_iter+0x1d4/0x5d0 fs/ext4/file.c:130
 call_read_iter include/linux/fs.h:1971 [inline]
 generic_file_splice_read+0x450/0x6c0 fs/splice.c:311
 do_splice_to+0x1bf/0x250 fs/splice.c:796
 splice_direct_to_actor+0x2c2/0x8c0 fs/splice.c:870
 do_splice_direct+0x1b3/0x280 fs/splice.c:979
 do_sendfile+0x9f0/0x1110 fs/read_write.c:1261
 __do_sys_sendfile64 fs/read_write.c:1326 [inline]
 __se_sys_sendfile64 fs/read_write.c:1312 [inline]
 __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1312
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb23b7ac188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 00008400fffffffa R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffd3b53a52f R14: 00007fb23b7ac300 R15: 0000000000022000
syz-executor.4 (11804) used greatest stack depth: 22968 bytes left

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-linux-next-kasan-gce-root	2021/02/01 19:05	linux-next	fd821bf0ed9a	e6b95f32	.config	log	report			info	BUG: Bad page state
ci-upstream-linux-next-kasan-gce-root	2021/01/28 10:01	linux-next	d03154e8bb6a	eefc07f2	.config	log	report			info	BUG: Bad page state