./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1486007851 <...> Warning: Permanently added '10.128.1.36' (ED25519) to the list of known hosts. execve("./syz-executor1486007851", ["./syz-executor1486007851"], 0x7fff82728380 /* 10 vars */) = 0 brk(NULL) = 0x555555ace000 brk(0x555555aced00) = 0x555555aced00 arch_prctl(ARCH_SET_FS, 0x555555ace380) = 0 set_tid_address(0x555555ace650) = 5044 set_robust_list(0x555555ace660, 24) = 0 rseq(0x555555aceca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1486007851", 4096) = 28 getrandom("\x7f\xdc\x36\xc7\x7f\x3f\xec\xa7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555aced00 brk(0x555555aefd00) = 0x555555aefd00 brk(0x555555af0000) = 0x555555af0000 mprotect(0x7fb5b575c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555ace650) = 5045 ./strace-static-x86_64: Process 5045 attached [pid 5045] set_robust_list(0x555555ace660, 24) = 0 [pid 5045] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5045] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5045] setsid() = 1 [pid 5045] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5045] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5045] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5045] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5045] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5045] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5045] unshare(CLONE_NEWNS) = 0 [pid 5045] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5045] unshare(CLONE_NEWIPC) = 0 [pid 5045] unshare(CLONE_NEWCGROUP) = 0 [pid 5045] unshare(CLONE_NEWUTS) = 0 [pid 5045] unshare(CLONE_SYSVSEM) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "16777216", 8) = 8 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "536870912", 9) = 9 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1024", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "8192", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1024", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1024", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5045] close(3) = 0 [pid 5045] getpid() = 1 [pid 5045] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 45.970807][ T108] dump_stack_lvl+0x125/0x1b0 [ 45.975481][ T108] bad_page+0xb4/0x200 [ 45.979547][ T108] ? zone_batchsize+0xa0/0xa0 [ 45.984399][ T108] ? page_bad_reason+0x9d/0x190 [ 45.989248][ T108] free_unref_page_prepare+0x598/0xb90 [ 45.995162][ T108] ? mem_cgroup_swapin_charge_folio+0x2e0/0x300 [ 46.001408][ T108] ? reacquire_held_locks+0x4b0/0x4b0 [ 46.006776][ T108] free_unref_page+0x33/0x3b0 [ 46.011549][ T108] ? lock_release+0x4bf/0x680 [ 46.016234][ T108] __folio_put+0xc5/0x140 [ 46.020680][ T108] txUnlock+0x6bb/0xd10 [ 46.024857][ T108] jfs_lazycommit+0x726/0xb20 [ 46.029552][ T108] ? txCommit+0x4fc0/0x4fc0 [ 46.034057][ T108] ? wake_up_state+0x10/0x10 [ 46.038656][ T108] ? __kthread_parkme+0x152/0x220 [ 46.043675][ T108] ? txCommit+0x4fc0/0x4fc0 [ 46.048362][ T108] kthread+0x33a/0x430 [ 46.052632][ T108] ? kthread_complete_and_exit+0x40/0x40 [ 46.058278][ T108] ret_from_fork+0x2c/0x70 [ 46.063146][ T108] ? kthread_complete_and_exit+0x40/0x40 [ 46.068789][ T108] ret_from_fork_asm+0x11/0x20 [ 46.073584][ T108] [ 46.076710][ T108] page:ffffea0001cd4380 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x7350e [ 46.087008][ T108] flags: 0xfff00000002047(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff) [ 46.098163][ T108] page_type: 0xffffffff() [ 46.102536][ T108] raw: 00fff00000002047 dead000000000100 dead000000000122 0000000000000000 [ 46.111247][ T108] raw: 000000000000001c ffff888073fc09b0 00000000ffffffff 0000000000000000 [ 46.119953][ T108] page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u)) [ 46.130307][ T108] page_owner tracks the page as allocated [ 46.136147][ T108] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5045, tgid 5045 (syz-executor148), ts 45680447794, free_ts 13850326621 [ 46.153198][ T108] post_alloc_hook+0x2d2/0x350 [ 46.158088][ T108] get_page_from_freelist+0x10d7/0x31b0 [ 46.163630][ T108] __alloc_pages+0x1d0/0x4a0 [ 46.168242][ T108] alloc_pages+0x1a9/0x270 [ 46.172762][ T108] folio_alloc+0x1e/0x60 [ 46.177030][ T108] filemap_alloc_folio+0x3bb/0x490 [ 46.182266][ T108] do_read_cache_folio+0x1b2/0x540 [ 46.187415][ T108] read_cache_page+0x5b/0x180 [ 46.192099][ T108] __get_metapage+0x993/0x1170 [ 46.196906][ T108] diRead+0x650/0xb00 [ 46.200890][ T108] jfs_iget+0x84/0x4c0 [ 46.204947][ T108] jfs_fill_super+0x6c8/0xd20 [ 46.209746][ T108] mount_bdev+0x1f3/0x350 [ 46.214094][ T108] legacy_get_tree+0x109/0x220 [ 46.218904][ T108] vfs_get_tree+0x88/0x350 [ 46.223340][ T108] path_mount+0x1492/0x1ed0 [ 46.227920][ T108] page last free stack trace: [ 46.232588][ T108] free_unref_page_prepare+0x508/0xb90 [ 46.238169][ T108] free_unref_page+0x33/0x3b0 [ 46.242866][ T108] free_contig_range+0xb6/0x190 [ 46.247748][ T108] destroy_args+0x78c/0x9b0 [ 46.252284][ T108] debug_vm_pgtable+0x2363/0x40a0 [ 46.257459][ T108] do_one_initcall+0x117/0x630 [ 46.262335][ T108] kernel_init_freeable+0x5bd/0x8f0 [ 46.267675][ T108] kernel_init+0x1c/0x2a0 [ 46.272021][ T108] ret_from_fork+0x2c/0x70 [ 46.276508][ T108] ret_from_fork_asm+0x11/0x20 [ 46.281551][ T108] ------------[ cut here ]------------ [ 46.287025][ T108] kernel BUG at include/linux/mm.h:1454! [ 46.292676][ T108] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 46.298735][ T108] CPU: 1 PID: 108 Comm: jfsCommit Tainted: G B 6.5.0-rc4-next-20230804-syzkaller #0 [ 46.309566][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 46.319609][ T108] RIP: 0010:put_metapage+0x2d9/0x340 [ 46.324891][ T108] Code: 9a 8e fe 49 8d 6f ff e9 66 fe ff ff e8 90 ac e3 fe e9 d9 fd ff ff e8 56 9a 8e fe 48 c7 c6 60 75 aa 8a 48 89 ef e8 07 3d cc fe <0f> 0b 4c 89 ef e8 8d ac e3 fe e9 73 fd ff ff 4c 89 f7 e8 80 ac e3 [ 46.344580][ T108] RSP: 0018:ffffc90002cafd20 EFLAGS: 00010293 [ 46.350654][ T108] RAX: 0000000000000000 RBX: ffff888073fc09b0 RCX: 0000000000000000 [ 46.358626][ T108] RDX: ffff8880147d9dc0 RSI: ffffffff82f82859 RDI: 0000000000000000 [ 46.367056][ T108] RBP: ffffea0001cd4380 R08: 0000000000000000 R09: fffffbfff1d598ca [ 46.375116][ T108] R10: ffffffff8eacc657 R11: 1ffffffff19365a1 R12: ffffea0001cd43b4 [ 46.383100][ T108] R13: ffff888073fc0a40 R14: ffff888073fc09d8 R15: 000000000000007f [ 46.391072][ T108] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 46.400096][ T108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.406840][ T108] CR2: 00007fb5b572a0f8 CR3: 00000000262f4000 CR4: 00000000003506e0 [ 46.414816][ T108] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 46.422829][ T108] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 46.431150][ T108] Call Trace: [ 46.434455][ T108] [ 46.437384][ T108] ? die+0x31/0x80 [ 46.441123][ T108] ? do_trap+0x1ab/0x3b0 [ 46.445467][ T108] ? put_metapage+0x2d9/0x340 [ 46.450153][ T108] ? do_error_trap+0x9e/0x160 [ 46.454844][ T108] ? put_metapage+0x2d9/0x340 [ 46.459536][ T108] ? handle_invalid_op+0x2c/0x30 [ 46.464491][ T108] ? put_metapage+0x2d9/0x340 [ 46.469176][ T108] ? exc_invalid_op+0x2d/0x40 [ 46.474137][ T108] ? asm_exc_invalid_op+0x1a/0x20 [ 46.479265][ T108] ? put_metapage+0x2d9/0x340 [ 46.483951][ T108] ? put_metapage+0x2d9/0x340 [ 46.488639][ T108] txUnlock+0x46d/0xd10 [ 46.492813][ T108] jfs_lazycommit+0x726/0xb20 [ 46.497599][ T108] ? txCommit+0x4fc0/0x4fc0 [ 46.502129][ T108] ? wake_up_state+0x10/0x10 [ 46.506738][ T108] ? __kthread_parkme+0x152/0x220 [ 46.511771][ T108] ? txCommit+0x4fc0/0x4fc0 [ 46.516287][ T108] kthread+0x33a/0x430 [ 46.520369][ T108] ? kthread_complete_and_exit+0x40/0x40 [ 46.526099][ T108] ret_from_fork+0x2c/0x70 [ 46.530540][ T108] ? kthread_complete_and_exit+0x40/0x40 [ 46.536212][ T108] ret_from_fork_asm+0x11/0x20 [ 46.541015][ T108] [ 46.544039][ T108] Modules linked in: [ 46.548147][ T108] ---[ end trace 0000000000000000 ]--- [ 46.553701][ T108] RIP: 0010:put_metapage+0x2d9/0x340 [ 46.559058][ T108] Code: 9a 8e fe 49 8d 6f ff e9 66 fe ff ff e8 90 ac e3 fe e9 d9 fd ff ff e8 56 9a 8e fe 48 c7 c6 60 75 aa 8a 48 89 ef e8 07 3d cc fe <0f> 0b 4c 89 ef e8 8d ac e3 fe e9 73 fd ff ff 4c 89 f7 e8 80 ac e3 [ 46.578928][ T108] RSP: 0018:ffffc90002cafd20 EFLAGS: 00010293 [ 46.585020][ T108] RAX: 0000000000000000 RBX: ffff888073fc09b0 RCX: 0000000000000000 [ 46.593056][ T108] RDX: ffff8880147d9dc0 RSI: ffffffff82f82859 RDI: 0000000000000000 [ 46.601141][ T108] RBP: ffffea0001cd4380 R08: 0000000000000000 R09: fffffbfff1d598ca [ 46.609390][ T108] R10: ffffffff8eacc657 R11: 1ffffffff19365a1 R12: ffffea0001cd43b4 [ 46.617506][ T108] R13: ffff888073fc0a40 R14: ffff888073fc09d8 R15: 000000000000007f [ 46.625733][ T108] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 46.634902][ T108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.641689][ T108] CR2: 00007fb5b572a0f8 CR3: 00000000262f4000 CR4: 00000000003506e0 [ 46.649837][ T108] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 46.657976][ T108] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 46.666076][ T108] Kernel panic - not syncing: Fatal exception [ 46.672233][ T108] Kernel Offset: disabled [ 46.676783][ T108] Rebooting in 86400 seconds..