BUG: Bad page map in process syz-executor.4 pte:fffff7e670120 pmd:26292067 page:ffffea00020663c0 refcount:2 mapcount:-1 mapping:ffff88803a602b78 index:0x146 pfn:0x8198f memcg:ffff88807c79a000 aops:shmem_aops ino:2f77 dentry name:"memfd:syzkaller" flags: 0xfff00000080038(uptodate|dirty|lru|swapbacked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xfffffffe() raw: 00fff00000080038 ffffea0002066388 ffffea0001506208 ffff88803a602b78 raw: 0000000000000146 0000000000000000 00000002fffffffe ffff88807c79a000 page dumped because: bad pte page_owner tracks the page as allocated page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 25427, tgid 25426 (syz-executor.0), ts 2245995574194, free_ts 2245941009794 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1536 prep_new_page mm/page_alloc.c:1543 [inline] get_page_from_freelist+0x31ec/0x3370 mm/page_alloc.c:3183 __alloc_pages+0x255/0x670 mm/page_alloc.c:4439 __folio_alloc+0x13/0x30 mm/page_alloc.c:4471 vma_alloc_folio+0x48a/0x9a0 mm/mempolicy.c:2259 shmem_alloc_folio mm/shmem.c:1658 [inline] shmem_alloc_and_acct_folio+0x438/0x9b0 mm/shmem.c:1683 shmem_get_folio_gfp+0xca4/0x2b60 mm/shmem.c:2020 shmem_get_folio mm/shmem.c:2143 [inline] shmem_write_begin+0x170/0x300 mm/shmem.c:2688 generic_perform_write+0x31b/0x630 mm/filemap.c:3945 shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2865 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x782/0xaf0 fs/read_write.c:584 ksys_write+0x1a0/0x2c0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1136 [inline] free_unref_page_prepare+0x8c3/0x9f0 mm/page_alloc.c:2312 free_unref_page_list+0x596/0x830 mm/page_alloc.c:2451 release_pages+0x2113/0x23f0 mm/swap.c:1042 __folio_batch_release+0x84/0x100 mm/swap.c:1062 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x6ad/0x19c0 mm/shmem.c:1022 shmem_truncate_range mm/shmem.c:1114 [inline] shmem_evict_inode+0x29e/0xa80 mm/shmem.c:1243 evict+0x2a4/0x620 fs/inode.c:664 __dentry_kill+0x436/0x650 fs/dcache.c:607 dentry_kill+0xbb/0x290 dput+0x1f3/0x420 fs/dcache.c:913 __fput+0x60d/0x910 fs/file_table.c:392 task_work_run+0x24a/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xd9/0x100 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 addr:0000000020002000 vm_flags:08000070 anon_vma:0000000000000000 mapping:ffff888075f21b50 index:1 file:cgroup.controllers fault:xfs_filemap_fault mmap:xfs_file_mmap read_folio:xfs_vm_read_folio CPU: 1 PID: 25412 Comm: syz-executor.4 Not tainted 6.5.0-syzkaller-11704-g3f86ed6ec0b3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 print_bad_pte+0x581/0x5c0 mm/memory.c:535 zap_pte_range mm/memory.c:1458 [inline] zap_pmd_range mm/memory.c:1573 [inline] zap_pud_range mm/memory.c:1602 [inline] zap_p4d_range mm/memory.c:1623 [inline] unmap_page_range+0x1a76/0x3300 mm/memory.c:1644 unmap_vmas+0x209/0x3a0 mm/memory.c:1731 exit_mmap+0x297/0xc50 mm/mmap.c:3210 __mmput+0x115/0x3c0 kernel/fork.c:1349 exit_mm+0x21f/0x300 kernel/exit.c:567 do_exit+0x612/0x2290 kernel/exit.c:861 do_group_exit+0x206/0x2c0 kernel/exit.c:1024 get_signal+0x175d/0x1840 kernel/signal.c:2892 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:309 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:168 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f3b3827cae9 Code: Unable to access opcode bytes at 0x7f3b3827cabf. RSP: 002b:00007fff3c0ac3e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffdfc RBX: 0000000000224436 RCX: 00007f3b3827cae9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3b3839bf8c RBP: 0000000000000032 R08: 00007f3b3839bf8c R09: 00007f3b3839bf8c R10: 00007fff3c0ac520 R11: 0000000000000246 R12: 00007f3b3839bf8c R13: 0000000000224468 R14: 00007fff3c0ac540 R15: 00007fff3c0ac520 BUG: Bad rss-counter state mm:ffff888012869c80 type:MM_FILEPAGES val:1 BUG: Bad rss-counter state mm:ffff888012869c80 type:MM_SHMEMPAGES val:-1