BUG: Bad page state in process syz-executor209 pfn:7dee9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2d pfn:0x7dee9
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002d ffff88807a2722e8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5096, tgid 5096 (syz-executor209), ts 64771618076, free_ts 58121187864
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
__filemap_get_folio+0x44e/0xc10 mm/filemap.c:1950
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:87
find_or_create_page include/linux/pagemap.h:777 [inline]
grab_cache_page include/linux/pagemap.h:893 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225
vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4210
do_mkdirat+0x264/0x3a0 fs/namei.c:4233
page last free pid 5084 tgid 5084 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2588
tlb_batch_list_free mm/mmu_gather.c:159 [inline]
tlb_finish_mmu+0x11f/0x200 mm/mmu_gather.c:468
exit_mmap+0x44f/0xc80 mm/mmap.c:3354
__mmput+0x115/0x380 kernel/fork.c:1343
exit_mm+0x220/0x310 kernel/exit.c:566
do_exit+0x9b2/0x27f0 kernel/exit.c:864
do_group_exit+0x207/0x2c0 kernel/exit.c:1026
__do_sys_exit_group kernel/exit.c:1037 [inline]
__se_sys_exit_group kernel/exit.c:1035 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035
x64_sys_call+0x26c3/0x26d0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5098 Comm: syz-executor209 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:914 [inline]
free_pages_prepare mm/page_alloc.c:1085 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folios_put include/linux/mm.h:1572 [inline]
folio_batch_move_lru+0x5d7/0x690 mm/swap.c:227
folio_add_lru+0x39c/0x9e0 mm/swap.c:522
shmem_alloc_and_add_folio+0xa49/0xdb0 mm/shmem.c:1733
shmem_get_folio_gfp+0x82d/0x1f50 mm/shmem.c:2066
shmem_get_folio mm/shmem.c:2171 [inline]
shmem_write_begin+0x170/0x4d0 mm/shmem.c:2754
generic_perform_write+0x399/0x840 mm/filemap.c:4019
shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2930
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b5710bee0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 f1 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007fffc1930558 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fffc1930570 RCX: 00007f7b5710bee0
RDX: 0000000001000000 RSI: 00007f7b4ec00000 RDI: 0000000000000003
RBP: 00007f7b4ec00000 R08: 0000000000005dd3 R09: 0000000000005dcf
R10: 0000000000000774 R11: 0000000000000202 R12: 00007fffc1930710
R13: 00007fffc19305b0 R14: 0000000000000003 R15: 0000000001000000
BUG: Bad page state in process syz-executor209 pfn:7deea
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2e pfn:0x7deea
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002e ffff88807a2723e0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5096, tgid 5096 (syz-executor209), ts 64771645974, free_ts 55604629154
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
__filemap_get_folio+0x44e/0xc10 mm/filemap.c:1950
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:87
find_or_create_page include/linux/pagemap.h:777 [inline]
grab_cache_page include/linux/pagemap.h:893 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225
vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4210
do_mkdirat+0x264/0x3a0 fs/namei.c:4233
page last free pid 5083 tgid 5083 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2588
__folio_put+0x3b9/0x620 mm/swap.c:129
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:224 [inline]
pipe_read+0x6f2/0x13e0 fs/pipe.c:344
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x9bd/0xbc0 fs/read_write.c:476
ksys_read+0x1a0/0x2c0 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5098 Comm: syz-executor209 Tainted: G B 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:914 [inline]
free_pages_prepare mm/page_alloc.c:1085 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folios_put include/linux/mm.h:1572 [inline]
folio_batch_move_lru+0x5d7/0x690 mm/swap.c:227
folio_add_lru+0x39c/0x9e0 mm/swap.c:522
shmem_alloc_and_add_folio+0xa49/0xdb0 mm/shmem.c:1733
shmem_get_folio_gfp+0x82d/0x1f50 mm/shmem.c:2066
shmem_get_folio mm/shmem.c:2171 [inline]
shmem_write_begin+0x170/0x4d0 mm/shmem.c:2754
generic_perform_write+0x399/0x840 mm/filemap.c:4019
shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2930
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b5710bee0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 f1 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007fffc1930558 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fffc1930570 RCX: 00007f7b5710bee0
RDX: 0000000001000000 RSI: 00007f7b4ec00000 RDI: 0000000000000003
RBP: 00007f7b4ec00000 R08: 0000000000005dd3 R09: 0000000000005dcf
R10: 0000000000000774 R11: 0000000000000202 R12: 00007fffc1930710
R13: 00007fffc19305b0 R14: 0000000000000003 R15: 0000000001000000
BUG: Bad page state in process syz-executor209 pfn:7deeb
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2f pfn:0x7deeb
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002f ffff88807a2724d8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5096, tgid 5096 (syz-executor209), ts 64771671710, free_ts 55604641708
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
__filemap_get_folio+0x44e/0xc10 mm/filemap.c:1950
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:87
find_or_create_page include/linux/pagemap.h:777 [inline]
grab_cache_page include/linux/pagemap.h:893 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225
vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4210
do_mkdirat+0x264/0x3a0 fs/namei.c:4233
page last free pid 5083 tgid 5083 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2588
__folio_put+0x3b9/0x620 mm/swap.c:129
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:224 [inline]
pipe_read+0x6f2/0x13e0 fs/pipe.c:344
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x9bd/0xbc0 fs/read_write.c:476
ksys_read+0x1a0/0x2c0 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5098 Comm: syz-executor209 Tainted: G B 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:914 [inline]
free_pages_prepare mm/page_alloc.c:1085 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folios_put include/linux/mm.h:1572 [inline]
folio_batch_move_lru+0x5d7/0x690 mm/swap.c:227
folio_add_lru+0x39c/0x9e0 mm/swap.c:522
shmem_alloc_and_add_folio+0xa49/0xdb0 mm/shmem.c:1733
shmem_get_folio_gfp+0x82d/0x1f50 mm/shmem.c:2066
shmem_get_folio mm/shmem.c:2171 [inline]
shmem_write_begin+0x170/0x4d0 mm/shmem.c:2754
generic_perform_write+0x399/0x840 mm/filemap.c:4019
shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2930
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b5710bee0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 f1 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007fffc1930558 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fffc1930570 RCX: 00007f7b5710bee0
RDX: 0000000001000000 RSI: 00007f7b4ec00000 RDI: 0000000000000003
RBP: 00007f7b4ec00000 R08: 0000000000005dd3 R09: 0000000000005dcf
R10: 0000000000000774 R11: 0000000000000202 R12: 00007fffc1930710
R13: 00007fffc19305b0 R14: 0000000000000003 R15: 0000000001000000