BUG: Bad page cache in process syz-executor.0 pfn:5708a page: refcount:4 mapcount:1 mapping:00000000fa7f8175 index:0x0 pfn:0x5708a memcg:fdf000000c5f6000 aops:shmem_aops ino:40c flags: 0x1ffc0000008002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: 0x0() raw: 01ffc0000008002d ffffc1ffc05c1588 f0f0000007359800 f7f0000007092470 raw: 0000000000000000 0000000000000000 0000000400000000 fdf000000c5f6000 page dumped because: still mapped when deleted CPU: 1 PID: 4459 Comm: syz-executor.0 Not tainted 6.9.0-rc6-syzkaller-00053-g0106679839f7 #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x1ac/0x280 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x618 mm/shmem.c:1001 shmem_truncate_range mm/shmem.c:1114 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1242 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xb4/0x174 fs/dcache.c:400 __dentry_kill+0x7c/0x1d4 fs/dcache.c:603 dput fs/dcache.c:845 [inline] dput+0xf0/0x1c4 fs/dcache.c:833 __fput+0xbc/0x2c4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1541 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor.0 pfn:5708a page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0x5708a flags: 0x1ffc0000008000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: 0xfffffffe() raw: 01ffc0000008000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 1 PID: 4459 Comm: syz-executor.0 Tainted: G B 6.9.0-rc6-syzkaller-00053-g0106679839f7 #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:515 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:958 free_page_is_bad mm/page_alloc.c:968 [inline] free_pages_prepare mm/page_alloc.c:1133 [inline] free_unref_page_prepare+0x1b0/0x2b8 mm/page_alloc.c:2347 free_unref_folios+0x110/0x354 mm/page_alloc.c:2536 folios_put_refs+0x10c/0x288 mm/swap.c:1034 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x54/0xe4 mm/mmu_gather.c:373 zap_pte_range mm/memory.c:1683 [inline] zap_pmd_range mm/memory.c:1722 [inline] zap_pud_range mm/memory.c:1751 [inline] zap_p4d_range mm/memory.c:1772 [inline] unmap_page_range+0xa6c/0x1030 mm/memory.c:1793 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1839 unmap_vmas+0x7c/0x170 mm/memory.c:1883 exit_mmap+0xc8/0x27c mm/mmap.c:3267 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:569 [inline] do_exit+0x28c/0x994 kernel/exit.c:865 do_group_exit+0x34/0x90 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1036 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598