blkno = 5002c, nblocks = 1
ERROR: (device loop4): dbUpdatePMap: blocks are outside the map
ERROR: (device loop4): remounting filesystem as read-only
BUG: Bad page state in process jfsCommit  pfn:5f32d
page:ffffea00017ccb40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x5002c pfn:0x5f32d
flags: 0xfff00000002007(locked|referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002007 dead000000000100 dead000000000122 0000000000000000
raw: 000000000005002c ffff888029c140f8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 6284, tgid 6283 (syz.4.636), ts 163964969139, free_ts 158829630910
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5614
 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292
 filemap_alloc_folio+0xdb/0x460 mm/filemap.c:999
 __filemap_get_folio+0x697/0xdd0 mm/filemap.c:1993
 pagecache_get_page+0x26/0x250 mm/folio-compat.c:110
 find_or_create_page include/linux/pagemap.h:646 [inline]
 grab_cache_page include/linux/pagemap.h:778 [inline]
 __get_metapage+0x2a4/0xfa0 fs/jfs/jfs_metapage.c:613
 dtSplitRoot+0x1de/0x14e0 fs/jfs/jfs_dtree.c:1910
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xe2a/0x58a0 fs/jfs/jfs_dtree.c:871
 jfs_create+0x69d/0xa50 fs/jfs/namei.c:137
 lookup_open fs/namei.c:3482 [inline]
 open_last_lookups fs/namei.c:3550 [inline]
 path_openat+0x1187/0x2e70 fs/namei.c:3780
 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810
 do_sys_openat2+0x142/0x490 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_creat fs/open.c:1412 [inline]
 __se_sys_creat fs/open.c:1406 [inline]
 __x64_sys_creat+0x8c/0xb0 fs/open.c:1406
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3525
 release_pages+0x1f92/0x2200 mm/swap.c:1035
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu+0xff/0x210 mm/mmu_gather.c:261
 tlb_finish_mmu+0xbd/0x1c0 mm/mmu_gather.c:361
 exit_mmap+0x343/0x8e0 mm/mmap.c:3262
 __mmput+0x118/0x3c0 kernel/fork.c:1200
 exit_mm+0x1e6/0x2c0 kernel/exit.c:565
 do_exit+0x8c1/0x2400 kernel/exit.c:867
 do_group_exit+0x217/0x2d0 kernel/exit.c:1022
 get_signal+0x1272/0x1350 kernel/signal.c:2871
 arch_do_signal_or_restart+0xb0/0x1230 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
Modules linked in:
CPU: 1 PID: 106 Comm: jfsCommit Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 bad_page+0x14b/0x170 mm/page_alloc.c:699
 free_page_is_bad mm/page_alloc.c:1291 [inline]
 free_pages_prepare mm/page_alloc.c:1452 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x42a/0x9a0 mm/page_alloc.c:3384
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3479
 txUnlock+0x27e/0xcb0 fs/jfs/jfs_txnmgr.c:932
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x56c/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
page:ffffea00017ccb40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x5002c pfn:0x5f32d
flags: 0xfff00000002007(locked|referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002007 dead000000000100 dead000000000122 0000000000000000
raw: 000000000005002c ffff888029c140f8 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 6284, tgid 6283 (syz.4.636), ts 163964969139, free_ts 158829630910
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5614
 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292
 filemap_alloc_folio+0xdb/0x460 mm/filemap.c:999
 __filemap_get_folio+0x697/0xdd0 mm/filemap.c:1993
 pagecache_get_page+0x26/0x250 mm/folio-compat.c:110
 find_or_create_page include/linux/pagemap.h:646 [inline]
 grab_cache_page include/linux/pagemap.h:778 [inline]
 __get_metapage+0x2a4/0xfa0 fs/jfs/jfs_metapage.c:613
 dtSplitRoot+0x1de/0x14e0 fs/jfs/jfs_dtree.c:1910
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xe2a/0x58a0 fs/jfs/jfs_dtree.c:871
 jfs_create+0x69d/0xa50 fs/jfs/namei.c:137
 lookup_open fs/namei.c:3482 [inline]
 open_last_lookups fs/namei.c:3550 [inline]
 path_openat+0x1187/0x2e70 fs/namei.c:3780
 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810
 do_sys_openat2+0x142/0x490 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_creat fs/open.c:1412 [inline]
 __se_sys_creat fs/open.c:1406 [inline]
 __x64_sys_creat+0x8c/0xb0 fs/open.c:1406
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3525
 release_pages+0x1f92/0x2200 mm/swap.c:1035
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu+0xff/0x210 mm/mmu_gather.c:261
 tlb_finish_mmu+0xbd/0x1c0 mm/mmu_gather.c:361
 exit_mmap+0x343/0x8e0 mm/mmap.c:3262
 __mmput+0x118/0x3c0 kernel/fork.c:1200
 exit_mm+0x1e6/0x2c0 kernel/exit.c:565
 do_exit+0x8c1/0x2400 kernel/exit.c:867
 do_group_exit+0x217/0x2d0 kernel/exit.c:1022
 get_signal+0x1272/0x1350 kernel/signal.c:2871
 arch_do_signal_or_restart+0xb0/0x1230 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1146!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 106 Comm: jfsCommit Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:folio_get include/linux/mm.h:1146 [inline]
RIP: 0010:get_page include/linux/mm.h:1152 [inline]
RIP: 0010:put_metapage+0x24f/0x340 fs/jfs/jfs_metapage.c:721
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 5b 18 e4 fe e9 25 ff ff ff e8 41 eb 93 fe 48 8b 3c 24 48 c7 c6 80 2a c6 8a e8 71 79 ce fe <0f> 0b 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff e8 fa ee 93
RSP: 0018:ffffc90002637ce0 EFLAGS: 00010246
RAX: b60ebf2ba6485100 RBX: ffff888029c140f8 RCX: b60ebf2ba6485100
RDX: 0000000000000000 RSI: ffffffff8adefd00 RDI: ffffffff8adefcc0
RBP: 000000000000007f R08: dffffc0000000000 R09: fffffbfff1c3ecb6
R10: fffffbfff1c3ecb6 R11: 1ffffffff1c3ecb5 R12: ffff888029c14120
R13: ffffea00017ccb74 R14: 1ffff11005382824 R15: 1ffff11005382831
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2b74fb4198 CR3: 000000007e13f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 txUnlock+0x427/0xcb0 fs/jfs/jfs_txnmgr.c:947
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x56c/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_get include/linux/mm.h:1146 [inline]
RIP: 0010:get_page include/linux/mm.h:1152 [inline]
RIP: 0010:put_metapage+0x24f/0x340 fs/jfs/jfs_metapage.c:721
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 5b 18 e4 fe e9 25 ff ff ff e8 41 eb 93 fe 48 8b 3c 24 48 c7 c6 80 2a c6 8a e8 71 79 ce fe <0f> 0b 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff e8 fa ee 93
RSP: 0018:ffffc90002637ce0 EFLAGS: 00010246
RAX: b60ebf2ba6485100 RBX: ffff888029c140f8 RCX: b60ebf2ba6485100
RDX: 0000000000000000 RSI: ffffffff8adefd00 RDI: ffffffff8adefcc0
RBP: 000000000000007f R08: dffffc0000000000 R09: fffffbfff1c3ecb6
R10: fffffbfff1c3ecb6 R11: 1ffffffff1c3ecb5 R12: ffff888029c14120
R13: ffffea00017ccb74 R14: 1ffff11005382824 R15: 1ffff11005382831
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056233562a238 CR3: 000000007e559000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400