program: r0 = socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x101bff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) fcntl$setsig(r1, 0xa, 0x11) fcntl$setlease(r1, 0x400, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x161842, 0x0) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r2, 0x400, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) mq_open(0x0, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x80000040001}) r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000000)='\x00', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r4, r5, r5}, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={'poly1305-generic\x00'}}) r6 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt(r6, 0x10d, 0xe, &(0x7f00001c9fff)="03", 0x1) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000fb7963a8bef765e7e5230db1fbae25ace90000000000001000000000000000", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b0000000000"], 0x28}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="2400000983e8380e3f54b0fe21a27ae897c702005b6955edeaa3a84eee4264e46b192d59eada7a7ac917eabbeec2f611cf02972d9d23f5c55acdb9e89b7280d2789606e5b8842c80cf5fbd63e1acadbc34baaed6e9cc22fc2cc9230fe82e7b5b5dd1cf4622383d0b6df0b8fe0c96c7aa382a2dfb3aec8c2dde7adb61e7134dd2d92855e2a04c05495cb0854e3aa97f54f83d8b9edc32f100"/164, @ANYRES16=r10, @ANYBLOB="010000000000000000008900000008000300", @ANYRES32=r9, @ANYBLOB="08001d8004000000"], 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r7, 0x8b1a, &(0x7f0000000480)="e091e2d555f23cfd866773d827c07ffbffd8ccb18210106cbf6d7adfb12fd7f0b2ec13d9916be01146e9b3edc44d0780c964c58273cd0497a4410fce1ade7635ef6d5477ccb77075124681134d1d0117fcbc94e83e6688b02b89649b0712287c49cd4faa5558943b253dd8b5b66c7dfc42fdd6c7d7eeba8e4fa1926b96487b27a343be690a997c868d3ac7169592e4915ee25343300c50aa0000445038c5ad2075e3e247ba5434b9f4798f8ae2b6eb839f5ea546a2e077d25553dd378dfb49923731963af0faef955ba30c2bacc9e8cb3272080b6c7ca698bed06bcb51af0d6cab10a592d800bbac092029bb95f7f06aa37d163df1175a0000000000000000948f85176a0c3d628e89c1c7b95f2256f35a1ab94d9a53c9a598c2a3036ec98b5d4411e8c88777b2ac9fe368c61e1688657df9fcbc70fef19e0893fa72605d682cf9571309a3a063e43dbace47d1c6f019b9bfb984e1") syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) [ 69.313165][ T5308] Bluetooth: hci0: command tx timeout [ 69.607601][ T5325] page: refcount:3 mapcount:1 mapping:ffff8880532c5200 index:0x360 pfn:0x53417 [ 69.611772][ T5325] memcg:ffff888034144000 [ 69.613492][ T5325] aops:shmem_aops ino:4 [ 69.615255][ T5325] flags: 0x4fff6800002002d(locked|referenced|uptodate|lru|swapbacked|node=1|zone=1|lastcpupid=0x7ff) [ 69.620394][ T5325] raw: 04fff6800002002d ffffea00014d0588 ffffea00014d0608 ffff8880532c5200 [ 69.623478][ T5325] raw: 0000000000000360 0000000000000000 0000000300000000 ffff888034144000 [ 69.626622][ T5325] page dumped because: VM_BUG_ON_FOLIO(folio_mapped(folio)) [ 69.629650][ T5325] page_owner tracks the page as allocated [ 69.632782][ T5325] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5323, tgid 5322 (syz.0.0), ts 69442015743, free_ts 0 [ 69.638968][ T5325] post_alloc_hook+0x1f4/0x240 [ 69.640967][ T5325] get_page_from_freelist+0x365c/0x37a0 [ 69.643098][ T5325] __alloc_frozen_pages_noprof+0x292/0x710 [ 69.645514][ T5325] alloc_pages_mpol+0x311/0x660 [ 69.647788][ T5325] folio_alloc_mpol_noprof+0x36/0x70 [ 69.650188][ T5325] shmem_alloc_and_add_folio+0x4a0/0x1090 [ 69.652853][ T5325] shmem_get_folio_gfp+0x621/0x1840 [ 69.655048][ T5325] shmem_fault+0x220/0x5b0 [ 69.656878][ T5325] __do_fault+0x135/0x390 [ 69.658656][ T5325] __handle_mm_fault+0x4c44/0x70f0 [ 69.660773][ T5325] handle_mm_fault+0x3e5/0x8d0 [ 69.665173][ T5325] __get_user_pages+0x1a92/0x4140 [ 69.667545][ T5325] populate_vma_page_range+0x264/0x330 [ 69.669727][ T5325] __mm_populate+0x27a/0x460 [ 69.671611][ T5325] vm_mmap_pgoff+0x303/0x430 [ 69.673310][ T5325] do_syscall_64+0xf3/0x230 [ 69.675048][ T5325] page_owner free stack trace missing [ 69.677395][ T5325] ------------[ cut here ]------------ [ 69.679891][ T5325] kernel BUG at mm/filemap.c:154! [ 69.682425][ T5325] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 69.685311][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.14.0-rc2-syzkaller-00056-gab68d7eb7b1a #0 [ 69.689525][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.694496][ T5325] RIP: 0010:filemap_unaccount_folio+0x73d/0x7d0 [ 69.697221][ T5325] Code: de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 fb f3 11 00 90 0f 0b e8 a3 de c7 ff 48 89 df 48 c7 c6 c0 d2 13 8c e8 e4 f3 11 00 90 <0f> 0b e8 8c de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 cd f3 11 00 [ 69.704643][ T5325] RSP: 0018:ffffc9000d437490 EFLAGS: 00010046 [ 69.707559][ T5325] RAX: 73ab402b2582f000 RBX: ffffea00014d05c0 RCX: ffffc9000d437003 [ 69.711373][ T5325] RDX: 0000000000000002 RSI: ffffffff8c0ab8e0 RDI: ffffffff8c608cc0 [ 69.714571][ T5325] RBP: 0000000000000000 R08: ffffffff901b6077 R09: 1ffffffff2036c0e [ 69.717572][ T5325] R10: dffffc0000000000 R11: fffffbfff2036c0f R12: dffffc0000000000 [ 69.720755][ T5325] R13: 1ffffd400029a0b9 R14: ffff8880532c5200 R15: ffffea00014d05c8 [ 69.723745][ T5325] FS: 00007f64cb1336c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 69.727672][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.731298][ T5325] CR2: 000040000026f100 CR3: 000000003d8ba000 CR4: 0000000000352ef0 [ 69.734871][ T5325] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.738002][ T5325] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.741623][ T5325] Call Trace: [ 69.743241][ T5325] [ 69.744469][ T5325] ? __die_body+0x5f/0xb0 [ 69.746217][ T5325] ? die+0x9e/0xc0 [ 69.747739][ T5325] ? do_trap+0x15a/0x3a0 [ 69.749402][ T5325] ? filemap_unaccount_folio+0x73d/0x7d0 [ 69.751731][ T5325] ? do_error_trap+0x1dc/0x2c0 [ 69.753662][ T5325] ? filemap_unaccount_folio+0x73d/0x7d0 [ 69.756041][ T5325] ? __pfx_do_error_trap+0x10/0x10 [ 69.758283][ T5325] ? report_bug+0x3cd/0x500 [ 69.760075][ T5325] ? handle_invalid_op+0x34/0x40 [ 69.762354][ T5325] ? filemap_unaccount_folio+0x73d/0x7d0 [ 69.764811][ T5325] ? exc_invalid_op+0x38/0x50 [ 69.766841][ T5325] ? asm_exc_invalid_op+0x1a/0x20 [ 69.769421][ T5325] ? filemap_unaccount_folio+0x73d/0x7d0 [ 69.772244][ T5325] __filemap_remove_folio+0xc7/0x670 [ 69.774576][ T5325] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 69.777111][ T5325] ? __pfx___filemap_remove_folio+0x10/0x10 [ 69.779907][ T5325] ? _raw_spin_lock_irq+0xdf/0x120 [ 69.782166][ T5325] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 69.784353][ T5325] ? do_raw_spin_unlock+0x58/0x8b0 [ 69.786467][ T5325] filemap_remove_folio+0xe1/0x1f0 [ 69.788458][ T5325] truncate_inode_folio+0x5d/0x70 [ 69.790603][ T5325] shmem_undo_range+0x44b/0x1820 [ 69.792779][ T5325] ? __pfx_shmem_undo_range+0x10/0x10 [ 69.794942][ T5325] ? __pfx_validate_chain+0x10/0x10 [ 69.797083][ T5325] ? percpu_counter_add_batch+0xff/0x1f0 [ 69.799581][ T5325] shmem_evict_inode+0x29b/0xa80 [ 69.801686][ T5325] ? inode_wait_for_writeback+0x111/0x2a0 [ 69.803934][ T5325] ? __pfx_shmem_evict_inode+0x10/0x10 [ 69.806144][ T5325] ? do_raw_spin_unlock+0x58/0x8b0 [ 69.808310][ T5325] ? __pfx_shmem_evict_inode+0x10/0x10 [ 69.810630][ T5325] evict+0x4e8/0x9a0 [ 69.812182][ T5325] ? __pfx_evict+0x10/0x10 [ 69.814039][ T5325] ? iput+0x713/0xa50 [ 69.815804][ T5325] __dentry_kill+0x20d/0x630 [ 69.817932][ T5325] ? dput+0x37/0x2b0 [ 69.819668][ T5325] dput+0x19f/0x2b0 [ 69.821514][ T5325] __fput+0x60b/0x9f0 [ 69.823214][ T5325] task_work_run+0x24f/0x310 [ 69.825242][ T5325] ? __pfx_task_work_run+0x10/0x10 [ 69.827346][ T5325] ? syscall_exit_to_user_mode+0xa3/0x340 [ 69.829877][ T5325] syscall_exit_to_user_mode+0x13f/0x340 [ 69.832499][ T5325] do_syscall_64+0x100/0x230 [ 69.834638][ T5325] ? clear_bhb_loop+0x35/0x90 [ 69.836958][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.839571][ T5325] RIP: 0033:0x7f64ca38cde9 [ 69.841506][ T5325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.849568][ T5325] RSP: 002b:00007f64cb133038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 69.853659][ T5325] RAX: 0000400000000000 RBX: 00007f64ca5a6160 RCX: 00007f64ca38cde9 [ 69.856916][ T5325] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000400000000000 [ 69.859813][ T5325] RBP: 00007f64ca40e2a0 R08: 0000000000000007 R09: 0000000000000000 [ 69.863114][ T5325] R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000 [ 69.866971][ T5325] R13: 0000000000000001 R14: 00007f64ca5a6160 R15: 00007ffe3b6507b8 [ 69.870430][ T5325] [ 69.871610][ T5325] Modules linked in: [ 69.873069][ T5325] ---[ end trace 0000000000000000 ]--- [ 69.875060][ T5325] RIP: 0010:filemap_unaccount_folio+0x73d/0x7d0 [ 69.877556][ T5325] Code: de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 fb f3 11 00 90 0f 0b e8 a3 de c7 ff 48 89 df 48 c7 c6 c0 d2 13 8c e8 e4 f3 11 00 90 <0f> 0b e8 8c de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 cd f3 11 00 [ 69.887330][ T5325] RSP: 0018:ffffc9000d437490 EFLAGS: 00010046 [ 69.889960][ T5325] RAX: 73ab402b2582f000 RBX: ffffea00014d05c0 RCX: ffffc9000d437003 [ 69.893388][ T5325] RDX: 0000000000000002 RSI: ffffffff8c0ab8e0 RDI: ffffffff8c608cc0 [ 69.897276][ T5325] RBP: 0000000000000000 R08: ffffffff901b6077 R09: 1ffffffff2036c0e [ 69.901103][ T5325] R10: dffffc0000000000 R11: fffffbfff2036c0f R12: dffffc0000000000 [ 69.904565][ T5325] R13: 1ffffd400029a0b9 R14: ffff8880532c5200 R15: ffffea00014d05c8 [ 69.907711][ T5325] FS: 00007f64cb1336c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 69.911526][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.914505][ T5325] CR2: 000040000026f100 CR3: 000000003d8ba000 CR4: 0000000000352ef0 [ 69.917874][ T5325] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.920854][ T5325] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.923783][ T5325] Kernel panic - not syncing: Fatal exception [ 69.926459][ T5325] Kernel Offset: disabled [ 69.928592][ T5325] Rebooting in 86400 seconds..