./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3853584235 <...> Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts. execve("./syz-executor3853584235", ["./syz-executor3853584235"], 0x7ffc71c51b50 /* 10 vars */) = 0 brk(NULL) = 0x5555571a5000 brk(0x5555571a5d00) = 0x5555571a5d00 arch_prctl(ARCH_SET_FS, 0x5555571a5380) = 0 set_tid_address(0x5555571a5650) = 5029 set_robust_list(0x5555571a5660, 24) = 0 rseq(0x5555571a5ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3853584235", 4096) = 28 getrandom("\x22\xfa\xe2\x53\x9a\x5c\xe5\xff", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555571a5d00 brk(0x5555571c6d00) = 0x5555571c6d00 brk(0x5555571c7000) = 0x5555571c7000 mprotect(0x7fbb9001e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5030 attached [pid 5030] set_robust_list(0x5555571a5660, 24) = 0 [pid 5030] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5029] <... clone resumed>, child_tidptr=0x5555571a5650) = 5030 [pid 5030] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5030] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5030] setsid() = 1 [pid 5030] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5030] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5030] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5030] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5030] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5030] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5030] unshare(CLONE_NEWNS) = 0 [pid 5030] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5030] unshare(CLONE_NEWIPC) = 0 [pid 5030] unshare(CLONE_NEWCGROUP) = 0 [pid 5030] unshare(CLONE_NEWUTS) = 0 [pid 5030] unshare(CLONE_SYSVSEM) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "16777216", 8) = 8 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "536870912", 9) = 9 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "1024", 4) = 4 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "8192", 4) = 4 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "1024", 4) = 4 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "1024", 4) = 4 [pid 5030] close(3) = 0 [pid 5030] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5030] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5030] close(3) = 0 [pid 5030] getpid() = 1 [pid 5030] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 63.492199][ T108] dump_stack_lvl+0x1e7/0x2d0 [ 63.496862][ T108] ? nf_tcp_handle_invalid+0x650/0x650 [ 63.502301][ T108] ? is_module_text_address+0x180/0x180 [ 63.507832][ T108] ? dump_page+0x9c2/0x1090 [ 63.512322][ T108] bad_page+0x14b/0x170 [ 63.516489][ T108] free_unref_page_prepare+0x97c/0x9f0 [ 63.521948][ T108] free_unref_page+0x37/0x3f0 [ 63.526629][ T108] txUnlock+0x282/0xca0 [ 63.530770][ T108] ? lockdep_hardirqs_on+0x98/0x140 [ 63.535952][ T108] jfs_lazycommit+0x5d4/0xb70 [ 63.540610][ T108] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 63.546493][ T108] ? lockdep_hardirqs_on+0x98/0x140 [ 63.551690][ T108] ? txFreelock+0x580/0x580 [ 63.556182][ T108] ? do_task_dead+0xd0/0xd0 [ 63.560684][ T108] kthread+0x2d3/0x370 [ 63.564740][ T108] ? txFreelock+0x580/0x580 [ 63.569231][ T108] ? kthread_blkcg+0xd0/0xd0 [ 63.573816][ T108] ret_from_fork+0x48/0x80 [ 63.578221][ T108] ? kthread_blkcg+0xd0/0xd0 [ 63.582805][ T108] ret_from_fork_asm+0x11/0x20 [ 63.587570][ T108] [ 63.591752][ T108] Disabling lock debugging due to kernel taint [ 63.597955][ T108] page:ffffea0001cddc00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x73770 [ 63.608223][ T108] flags: 0xfff00000008009(locked|uptodate|private|node=0|zone=1|lastcpupid=0x7ff) [ 63.617450][ T108] page_type: 0xffffffff() [ 63.621819][ T108] raw: 00fff00000008009 dead000000000100 dead000000000122 0000000000000000 [ 63.630890][ T108] raw: 000000000000001c ffff888073579000 00000000ffffffff 0000000000000000 [ 63.639590][ T108] page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u)) [ 63.649966][ T108] page_owner tracks the page as allocated [ 63.655898][ T108] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5030, tgid 5030 (syz-executor385), ts 63184822697, free_ts 15219889891 [ 63.672950][ T108] post_alloc_hook+0x1e6/0x210 [ 63.677722][ T108] get_page_from_freelist+0x31db/0x3360 [ 63.683736][ T108] __alloc_pages+0x255/0x670 [ 63.688326][ T108] folio_alloc+0x1e/0x60 [ 63.692611][ T108] filemap_alloc_folio+0xde/0x500 [ 63.697642][ T108] do_read_cache_folio+0xed/0x810 [ 63.702691][ T108] do_read_cache_page+0x30/0x210 [ 63.707635][ T108] __get_metapage+0x330/0x1040 [ 63.712433][ T108] diRead+0x5f4/0xae0 [ 63.716402][ T108] jfs_iget+0x8c/0x3b0 [ 63.720461][ T108] jfs_fill_super+0x808/0xc50 [ 63.725160][ T108] mount_bdev+0x237/0x300 [ 63.729492][ T108] legacy_get_tree+0xef/0x190 [ 63.734201][ T108] vfs_get_tree+0x8c/0x280 [ 63.738619][ T108] do_new_mount+0x28f/0xae0 [ 63.743136][ T108] __se_sys_mount+0x2d9/0x3c0 [ 63.747815][ T108] page last free stack trace: [ 63.752506][ T108] free_unref_page_prepare+0x8c3/0x9f0 [ 63.757968][ T108] free_unref_page+0x37/0x3f0 [ 63.762662][ T108] free_contig_range+0x9e/0x150 [ 63.767510][ T108] destroy_args+0x95/0x7c0 [ 63.771945][ T108] debug_vm_pgtable+0x4ba/0x540 [ 63.776790][ T108] do_one_initcall+0x23d/0x7d0 [ 63.781533][ T108] do_initcall_level+0x157/0x210 [ 63.786493][ T108] do_initcalls+0x3f/0x80 [ 63.790823][ T108] kernel_init_freeable+0x429/0x5c0 [ 63.796046][ T108] kernel_init+0x1d/0x2a0 [ 63.800377][ T108] ret_from_fork+0x48/0x80 [ 63.804816][ T108] ret_from_fork_asm+0x11/0x20 [ 63.810056][ T108] ------------[ cut here ]------------ [ 63.815555][ T108] kernel BUG at include/linux/mm.h:1441! [ 63.821199][ T108] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 63.827264][ T108] CPU: 0 PID: 108 Comm: jfsCommit Tainted: G B 6.6.0-rc5-syzkaller-00055-g1c8b86a3799f #0 [ 63.838538][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 63.848590][ T108] RIP: 0010:put_metapage+0x264/0x300 [ 63.853870][ T108] Code: 2c 24 49 81 e5 ff 0f 00 00 74 21 e8 36 11 7c fe e9 9b 00 00 00 e8 2c 11 7c fe 48 8b 3c 24 48 c7 c6 e0 35 42 8b e8 bc f2 bd fe <0f> 0b 48 8b 1c 24 48 89 df be 08 00 00 00 e8 79 8f d6 fe 48 c1 eb [ 63.873468][ T108] RSP: 0018:ffffc90002cd7c98 EFLAGS: 00010246 [ 63.879529][ T108] RAX: f9cf1121afbe5b00 RBX: 000000000000007f RCX: ffffffff816d7830 [ 63.887496][ T108] RDX: 0000000000000000 RSI: ffffffff8b5982c0 RDI: ffffffff8b598280 [ 63.895458][ T108] RBP: ffff888073579000 R08: ffffffff8e9a322f R09: 1ffffffff1d34645 [ 63.903420][ T108] R10: dffffc0000000000 R11: fffffbfff1d34646 R12: dffffc0000000000 [ 63.911382][ T108] R13: ffffea0001cddc34 R14: 1ffff1100e6af205 R15: ffff888073579028 [ 63.919345][ T108] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 63.928262][ T108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 63.934835][ T108] CR2: 00007fbb8ffec0f8 CR3: 000000002a75d000 CR4: 00000000003506f0 [ 63.942795][ T108] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 63.950751][ T108] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 63.958710][ T108] Call Trace: [ 63.961978][ T108] [ 63.964896][ T108] ? __die_body+0x8b/0xe0 [ 63.969217][ T108] ? die+0xa1/0xd0 [ 63.972926][ T108] ? do_trap+0x153/0x380 [ 63.977158][ T108] ? put_metapage+0x264/0x300 [ 63.982084][ T108] ? do_error_trap+0x1dc/0x2c0 [ 63.986836][ T108] ? put_metapage+0x264/0x300 [ 63.991500][ T108] ? do_int3+0x50/0x50 [ 63.995561][ T108] ? handle_invalid_op+0x34/0x40 [ 64.000488][ T108] ? put_metapage+0x264/0x300 [ 64.005150][ T108] ? exc_invalid_op+0x33/0x50 [ 64.009815][ T108] ? asm_exc_invalid_op+0x1a/0x20 [ 64.014832][ T108] ? lock_release+0xb0/0x9d0 [ 64.019412][ T108] ? put_metapage+0x264/0x300 [ 64.024077][ T108] ? put_metapage+0x264/0x300 [ 64.028741][ T108] txUnlock+0x42f/0xca0 [ 64.032897][ T108] jfs_lazycommit+0x5d4/0xb70 [ 64.037562][ T108] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 64.043447][ T108] ? lockdep_hardirqs_on+0x98/0x140 [ 64.048640][ T108] ? txFreelock+0x580/0x580 [ 64.053128][ T108] ? do_task_dead+0xd0/0xd0 [ 64.057619][ T108] kthread+0x2d3/0x370 [ 64.061671][ T108] ? txFreelock+0x580/0x580 [ 64.066168][ T108] ? kthread_blkcg+0xd0/0xd0 [ 64.070752][ T108] ret_from_fork+0x48/0x80 [ 64.075157][ T108] ? kthread_blkcg+0xd0/0xd0 [ 64.079737][ T108] ret_from_fork_asm+0x11/0x20 [ 64.084757][ T108] [ 64.087760][ T108] Modules linked in: [ 64.092226][ T108] ---[ end trace 0000000000000000 ]--- [ 64.097693][ T108] RIP: 0010:put_metapage+0x264/0x300 [ 64.103069][ T108] Code: 2c 24 49 81 e5 ff 0f 00 00 74 21 e8 36 11 7c fe e9 9b 00 00 00 e8 2c 11 7c fe 48 8b 3c 24 48 c7 c6 e0 35 42 8b e8 bc f2 bd fe <0f> 0b 48 8b 1c 24 48 89 df be 08 00 00 00 e8 79 8f d6 fe 48 c1 eb [ 64.122822][ T108] RSP: 0018:ffffc90002cd7c98 EFLAGS: 00010246 [ 64.128904][ T108] RAX: f9cf1121afbe5b00 RBX: 000000000000007f RCX: ffffffff816d7830 [ 64.136941][ T108] RDX: 0000000000000000 RSI: ffffffff8b5982c0 RDI: ffffffff8b598280 [ 64.144949][ T108] RBP: ffff888073579000 R08: ffffffff8e9a322f R09: 1ffffffff1d34645 [ 64.152956][ T108] R10: dffffc0000000000 R11: fffffbfff1d34646 R12: dffffc0000000000 [ 64.160928][ T108] R13: ffffea0001cddc34 R14: 1ffff1100e6af205 R15: ffff888073579028 [ 64.168920][ T108] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 64.177861][ T108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 64.184460][ T108] CR2: 00007fbb8ffec0f8 CR3: 000000002a75d000 CR4: 00000000003506f0 [ 64.192445][ T108] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 64.200402][ T108] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 64.208398][ T108] Kernel panic - not syncing: Fatal exception [ 64.214649][ T108] Kernel Offset: disabled [ 64.218957][ T108] Rebooting in 86400 seconds..