BUG: Bad page state in process syz-executor.1  pfn:470af
page:ffffea00011c2bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 dead000000000100 dead000000000200 0000000000000000
raw: 0000000000000000 ffff88800f5d2b58 00000000ffffffff 0000000000000000
page dumped because: nonzero mapcount
Modules linked in:
CPU: 0 PID: 9140 Comm: syz-executor.1 Not tainted 5.0.0-rc6-next-20190213 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 bad_page.cold+0xda/0xff mm/page_alloc.c:586
 free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1014
 free_pages_check mm/page_alloc.c:1023 [inline]
 free_pages_prepare mm/page_alloc.c:1113 [inline]
 free_pcp_prepare mm/page_alloc.c:1138 [inline]
 free_unref_page_prepare mm/page_alloc.c:2991 [inline]
 free_unref_page+0x3c6/0x600 mm/page_alloc.c:3040
 __put_single_page mm/swap.c:79 [inline]
 __put_page+0x8d/0xd0 mm/swap.c:113
 put_page include/linux/mm.h:1026 [inline]
 generic_pipe_buf_release+0x100/0x160 fs/pipe.c:224
 pipe_buf_release include/linux/pipe_fs_i.h:129 [inline]
 iter_file_splice_write+0x7d1/0xbe0 fs/splice.c:759
 do_splice_from fs/splice.c:847 [inline]
 direct_splice_actor+0x126/0x1a0 fs/splice.c:1019
 splice_direct_to_actor+0x369/0x970 fs/splice.c:974
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1062
 do_sendfile+0x597/0xd00 fs/read_write.c:1436
 __do_sys_sendfile64 fs/read_write.c:1491 [inline]
 __se_sys_sendfile64 fs/read_write.c:1483 [inline]
 __x64_sys_sendfile64+0x15a/0x220 fs/read_write.c:1483
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e39
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f86ee889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457e39
RDX: 00000000200ddff8 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000102000000 R11: 0000000000000246 R12: 00007f86ee88a6d4
R13: 00000000004c4def R14: 00000000004d8a78 R15: 00000000ffffffff
BUG: Bad page state in process syz-executor.1  pfn:61dd5
page:ffffea0001877540 count:0 mapcount:0 mapping:ffff88821b440640 index:0x0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00017b74c8 ffffea0001401c88 ffff88821b440640
raw: 0000000000000000 ffff888061dd5000 0000000000000024 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
bad because of flags: 0x200(slab)
Modules linked in:
CPU: 1 PID: 9140 Comm: syz-executor.1 Tainted: G    B D           5.0.0-rc6-next-20190213 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 bad_page.cold+0xda/0xff mm/page_alloc.c:586
 free_pages_check_bad+0x142/0x1a0 mm/page_alloc.c:1014
 free_pages_check mm/page_alloc.c:1023 [inline]
 free_pages_prepare mm/page_alloc.c:1113 [inline]
 free_pcp_prepare mm/page_alloc.c:1138 [inline]
 free_unref_page_prepare mm/page_alloc.c:2991 [inline]
 free_unref_page+0x3c6/0x600 mm/page_alloc.c:3040
 __put_single_page mm/swap.c:79 [inline]
 __put_page+0x8d/0xd0 mm/swap.c:113
 put_page include/linux/mm.h:1026 [inline]
 generic_pipe_buf_release+0x100/0x160 fs/pipe.c:224
 pipe_buf_release include/linux/pipe_fs_i.h:129 [inline]
 iter_file_splice_write+0x7d1/0xbe0 fs/splice.c:759
 do_splice_from fs/splice.c:847 [inline]
 direct_splice_actor+0x126/0x1a0 fs/splice.c:1019
 splice_direct_to_actor+0x369/0x970 fs/splice.c:974
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1062
 do_sendfile+0x597/0xd00 fs/read_write.c:1436
 __do_sys_sendfile64 fs/read_write.c:1491 [inline]
 __se_sys_sendfile64 fs/read_write.c:1483 [inline]
 __x64_sys_sendfile64+0x15a/0x220 fs/read_write.c:1483
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e39
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f86ee889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457e39
RDX: 00000000200ddff8 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000102000000 R11: 0000000000000246 R12: 00007f86ee88a6d4
R13: 00000000004c4def R14: 00000000004d8a78 R15: 00000000ffffffff
page:ffffea00014d72c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea00017e8548 ffffea00019ccc48 0000000000000000
raw: 0000000000000000 ffff88800f5d2bb0 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)