__fput+0x44f/0xa60 fs/file_table.c:510 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x70f/0x22c0 kernel/exit.c:976 do_group_exit+0x21b/0x2d0 kernel/exit.c:1119 get_signal+0x1284/0x1330 kernel/signal.c:3038 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0xa9/0x680 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f ------------[ cut here ]------------ kernel BUG at mm/filemap.c:860! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 11971 Comm: syz.6.1097 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:__filemap_add_folio+0x11bc/0x1330 mm/filemap.c:859 Code: 15 c3 ff 4c 89 e7 48 c7 c6 40 b8 d7 8b e8 1c 6b 25 ff 90 0f 0b e8 54 15 c3 ff 4c 89 e7 48 c7 c6 40 ac d7 8b e8 05 6b 25 ff 90 <0f> 0b e8 3d 15 c3 ff 4c 89 e7 48 c7 c6 40 b8 d7 8b e8 ee 6a 25 ff RSP: 0018:ffffc900056966e0 EFLAGS: 00010246 RAX: 8c2d43216188c800 RBX: 0000000000000002 RCX: 0000000000000046 RDX: 0000000000000003 RSI: ffffffff8e217295 RDI: ffff888026a81f00 RBP: ffffc90005696860 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1cfd240 R12: ffffea000147d500 R13: dffffc0000000000 R14: ffffea000147d508 R15: 0000000000000004 FS: 00007f21e36736c0(0000) GS:ffff8881253a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000649cd000 CR4: 0000000000350ef0 Call Trace: filemap_add_folio+0x264/0x530 mm/filemap.c:967 ra_alloc_folio mm/readahead.c:456 [inline] page_cache_ra_order+0x6a9/0xe80 mm/readahead.c:515 do_async_mmap_readahead mm/filemap.c:3442 [inline] filemap_fault+0x5bf/0x1300 mm/filemap.c:3541 __do_fault+0x138/0x2a0 mm/memory.c:5474 do_read_fault mm/memory.c:5909 [inline] do_fault mm/memory.c:6043 [inline] do_pte_missing+0x2093/0x33f0 mm/memory.c:4566 handle_pte_fault mm/memory.c:6427 [inline] __handle_mm_fault mm/memory.c:6565 [inline] handle_mm_fault+0x1bf2/0x3170 mm/memory.c:6734 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x167f/0x2730 mm/gup.c:1428 __get_user_pages_locked mm/gup.c:1692 [inline] __gup_longterm_locked+0xdcf/0x1630 mm/gup.c:2476 gup_fast_fallback+0x1d84/0x20d0 mm/gup.c:3209 iov_iter_extract_user_pages lib/iov_iter.c:1763 [inline] iov_iter_extract_pages+0x37b/0x5f0 lib/iov_iter.c:1826 iov_iter_extract_bvecs+0xb1/0x920 lib/iov_iter.c:1917 bio_iov_iter_get_pages+0x346/0x930 block/bio.c:1266 iomap_dio_bio_iter_one fs/iomap/direct-io.c:360 [inline] iomap_dio_bio_iter+0xc9c/0x18b0 fs/iomap/direct-io.c:546 iomap_dio_iter fs/iomap/direct-io.c:-1 [inline] __iomap_dio_rw+0xf72/0x1e40 fs/iomap/direct-io.c:807 iomap_dio_rw+0x45/0xb0 fs/iomap/direct-io.c:901 ext4_dio_write_iter fs/ext4/file.c:592 [inline] ext4_file_write_iter+0x171c/0x1bf0 fs/ext4/file.c:733 do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1 vfs_writev+0x33c/0x990 fs/read_write.c:1059 do_pwritev fs/read_write.c:1155 [inline] __do_sys_pwritev2 fs/read_write.c:1213 [inline] __se_sys_pwritev2+0x184/0x2a0 fs/read_write.c:1204 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f21e279ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f21e3673028 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007f21e2a15fa0 RCX: 00007f21e279ce59 RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000008 RBP: 00007f21e2832d6f R08: 0000000000000000 R09: 0000000000000003 R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f21e2a16038 R14: 00007f21e2a15fa0 R15: 00007ffce55d55c8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__filemap_add_folio+0x11bc/0x1330 mm/filemap.c:859 Code: 15 c3 ff 4c 89 e7 48 c7 c6 40 b8 d7 8b e8 1c 6b 25 ff 90 0f 0b e8 54 15 c3 ff 4c 89 e7 48 c7 c6 40 ac d7 8b e8 05 6b 25 ff 90 <0f> 0b e8 3d 15 c3 ff 4c 89 e7 48 c7 c6 40 b8 d7 8b e8 ee 6a 25 ff RSP: 0018:ffffc900056966e0 EFLAGS: 00010246 RAX: 8c2d43216188c800 RBX: 0000000000000002 RCX: 0000000000000046 RDX: 0000000000000003 RSI: ffffffff8e217295 RDI: ffff888026a81f00 RBP: ffffc90005696860 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff1cfd240 R12: ffffea000147d500 R13: dffffc0000000000 R14: ffffea000147d508 R15: 0000000000000004 FS: 00007f21e36736c0(0000) GS:ffff8881253a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000649cd000 CR4: 0000000000350ef0