program: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r1, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) (async) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async, rerun: 32) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r3, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x1, 0xc}}}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "b30bd81e6e"}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x28a14f5fc1695de0) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000cc0)={0x48, r3, 0x1, 0x0, 0xfffffffc, {{0x2}, {@val={0x8, 0x3, r5}, @val={0xc}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}]]}, 0x48}}, 0x4) [ 85.118346][ T5344] Bluetooth: hci0: command tx timeout [ 85.180546][ T5367] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x1f pfn:0x53047 [ 85.184273][ T5367] memcg:ffff888030ad8d00 [ 85.186051][ T5367] flags: 0x4fff00000000001(locked|node=1|zone=1|lastcpupid=0x7ff) [ 85.195132][ T5367] raw: 04fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 85.205468][ T5367] raw: 000000000000001f 0000000000000000 00000001ffffffff ffff888030ad8d00 [ 85.211956][ T5367] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 85.216765][ T5367] page_owner tracks the page as allocated [ 85.223094][ T5367] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5367, tgid 5367 (syz.0.0), ts 85180524679, free_ts 85180334211 [ 85.232237][ T5367] post_alloc_hook+0x240/0x2a0 [ 85.234333][ T5367] get_page_from_freelist+0x21e4/0x22c0 [ 85.236607][ T5367] __alloc_frozen_pages_noprof+0x181/0x370 [ 85.241342][ T5367] alloc_pages_mpol+0x232/0x4a0 [ 85.244204][ T5367] alloc_pages_noprof+0xa9/0x190 [ 85.246425][ T5367] folio_alloc_noprof+0x1e/0x30 [ 85.249038][ T5367] filemap_alloc_folio_noprof+0xdf/0x470 [ 85.251342][ T5367] page_cache_ra_order+0x4de/0xd40 [ 85.253521][ T5367] do_sync_mmap_readahead+0x25e/0x7a0 [ 85.256073][ T5367] filemap_fault+0x62c/0x1200 [ 85.258006][ T5367] __do_fault+0x135/0x390 [ 85.261188][ T5367] __handle_mm_fault+0x1847/0x5440 [ 85.263477][ T5367] handle_mm_fault+0x40a/0x8e0 [ 85.265534][ T5367] do_user_addr_fault+0xa81/0x1390 [ 85.267757][ T5367] exc_page_fault+0x76/0xf0 [ 85.270158][ T5367] asm_exc_page_fault+0x26/0x30 [ 85.272213][ T5367] page last free pid 5368 tgid 5367 stack trace: [ 85.274799][ T5367] free_unref_folios+0xdbd/0x1520 [ 85.277005][ T5367] folios_put_refs+0x559/0x640 [ 85.280564][ T5367] truncate_inode_pages_range+0x346/0xda0 [ 85.282938][ T5367] set_blocksize+0x32a/0x500 [ 85.284990][ T5367] blkdev_bszset+0x1ac/0x220 [ 85.286865][ T5367] blkdev_ioctl+0x430/0x6d0 [ 85.289519][ T5367] __se_sys_ioctl+0xfc/0x170 [ 85.291447][ T5367] do_syscall_64+0xfa/0x3b0 [ 85.293206][ T5367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.296130][ T5367] ------------[ cut here ]------------ [ 85.298765][ T5367] kernel BUG at mm/filemap.c:868! [ 85.301478][ T5367] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 85.303946][ T5367] CPU: 0 UID: 0 PID: 5367 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.307486][ T5367] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.311865][ T5367] RIP: 0010:__filemap_add_folio+0x11ad/0x12f0 [ 85.314416][ T5367] Code: cf c7 ff 4c 89 e7 48 c7 c6 80 4d 94 8b e8 4b 0d 30 ff 90 0f 0b e8 13 cf c7 ff 4c 89 e7 48 c7 c6 60 44 94 8b e8 34 0d 30 ff 90 <0f> 0b e8 fc ce c7 ff 4c 89 e7 48 c7 c6 80 4d 94 8b e8 1d 0d 30 ff [ 85.322493][ T5367] RSP: 0018:ffffc9000d4276a0 EFLAGS: 00010246 [ 85.325176][ T5367] RAX: a5089618c8f1b100 RBX: 0000000000000000 RCX: 0000000000000000 [ 85.328577][ T5367] RDX: 0000000000000007 RSI: ffffffff8d9bc3c7 RDI: 00000000ffffffff [ 85.331856][ T5367] RBP: ffffc9000d427810 R08: ffffffff8fa3c037 R09: 1ffffffff1f47806 [ 85.335178][ T5367] R10: dffffc0000000000 R11: fffffbfff1f47807 R12: ffffea00014c11c0 [ 85.338702][ T5367] R13: dffffc0000000000 R14: ffffea00014c11c8 R15: 0000000000000004 [ 85.342041][ T5367] FS: 0000555556087500(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000 [ 85.345653][ T5367] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.348616][ T5367] CR2: 000020000057eff8 CR3: 0000000032b60000 CR4: 0000000000352ef0 [ 85.352726][ T5367] Call Trace: [ 85.354669][ T5367] [ 85.356364][ T5367] ? percpu_ref_put+0x19/0x180 [ 85.359097][ T5367] ? __pfx___filemap_add_folio+0x10/0x10 [ 85.362315][ T5367] filemap_add_folio+0xd5/0x270 [ 85.364962][ T5367] page_cache_ra_order+0x643/0xd40 [ 85.367235][ T5367] do_sync_mmap_readahead+0x25e/0x7a0 [ 85.369418][ T5367] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 85.371888][ T5367] ? count_memcg_event_mm+0x1d/0x250 [ 85.374071][ T5367] ? count_memcg_event_mm+0x1d/0x250 [ 85.376245][ T5367] filemap_fault+0x62c/0x1200 [ 85.378284][ T5367] ? __pagetable_ctor+0x253/0x340 [ 85.380329][ T5367] ? __pfx_filemap_fault+0x10/0x10 [ 85.382501][ T5367] ? rcu_is_watching+0x15/0xb0 [ 85.384713][ T5367] ? __raw_spin_lock_init+0x45/0x100 [ 85.387067][ T5367] __do_fault+0x135/0x390 [ 85.388934][ T5367] __handle_mm_fault+0x1847/0x5440 [ 85.391054][ T5367] ? __lock_acquire+0xab9/0xd20 [ 85.393130][ T5367] ? __pfx___handle_mm_fault+0x10/0x10 [ 85.395422][ T5367] ? lock_vma_under_rcu+0xdf/0x3d0 [ 85.397566][ T5367] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 85.399756][ T5367] ? rcu_is_watching+0x15/0xb0 [ 85.401760][ T5367] handle_mm_fault+0x40a/0x8e0 [ 85.403763][ T5367] do_user_addr_fault+0xa81/0x1390 [ 85.406264][ T5367] ? rcu_is_watching+0x15/0xb0 [ 85.408252][ T5367] ? trace_page_fault_user+0x84/0x1e0 [ 85.410794][ T5367] exc_page_fault+0x76/0xf0 [ 85.413054][ T5367] asm_exc_page_fault+0x26/0x30 [ 85.415808][ T5367] RIP: 0033:0x7f1934a55003 [ 85.417789][ T5367] Code: 48 85 c0 74 1b 48 83 f8 01 0f 85 3b 03 00 00 0f b7 44 24 18 66 c1 c0 08 0f b7 c0 48 89 44 24 18 48 8b 44 24 10 0f b7 54 24 18 <66> 89 10 e9 82 fe ff ff 48 83 3c 24 08 0f 85 a1 02 00 00 48 8b 44 [ 85.426317][ T5367] RSP: 002b:00007ffddb8afd80 EFLAGS: 00010246 [ 85.428950][ T5367] RAX: 000020000057eff8 RBX: 0000000000000002 RCX: 0000000000000000 [ 85.431942][ T5367] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005555560873c8 [ 85.434789][ T5367] RBP: 00007ffddb8afe88 R08: 0000000000000000 R09: 0000000000000000 [ 85.437737][ T5367] R10: 0000000000000000 R11: 0000000000000000 R12: 00007f1934dc5fac [ 85.440946][ T5367] R13: 00007f1934dc5fa0 R14: fffffffffffffffe R15: 0000000000000003 [ 85.444328][ T5367] [ 85.445762][ T5367] Modules linked in: [ 85.447835][ T5367] ---[ end trace 0000000000000000 ]--- [ 85.454987][ T5367] RIP: 0010:__filemap_add_folio+0x11ad/0x12f0 [ 85.457359][ T5367] Code: cf c7 ff 4c 89 e7 48 c7 c6 80 4d 94 8b e8 4b 0d 30 ff 90 0f 0b e8 13 cf c7 ff 4c 89 e7 48 c7 c6 60 44 94 8b e8 34 0d 30 ff 90 <0f> 0b e8 fc ce c7 ff 4c 89 e7 48 c7 c6 80 4d 94 8b e8 1d 0d 30 ff [ 85.465666][ T5367] RSP: 0018:ffffc9000d4276a0 EFLAGS: 00010246 [ 85.468926][ T5367] RAX: a5089618c8f1b100 RBX: 0000000000000000 RCX: 0000000000000000 [ 85.472187][ T5367] RDX: 0000000000000007 RSI: ffffffff8d9bc3c7 RDI: 00000000ffffffff [ 85.475575][ T5367] RBP: ffffc9000d427810 R08: ffffffff8fa3c037 R09: 1ffffffff1f47806 [ 85.479557][ T5367] R10: dffffc0000000000 R11: fffffbfff1f47807 R12: ffffea00014c11c0 [ 85.483027][ T5367] R13: dffffc0000000000 R14: ffffea00014c11c8 R15: 0000000000000004 [ 85.486485][ T5367] FS: 0000555556087500(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000 [ 85.490640][ T5367] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.493247][ T5367] CR2: 000020000057eff8 CR3: 0000000032b60000 CR4: 0000000000352ef0 [ 85.496283][ T5367] Kernel panic - not syncing: Fatal exception [ 85.498982][ T5367] Kernel Offset: disabled [ 85.500983][ T5367] Rebooting in 86400 seconds..