ERROR: (device loop0): dbAlloc: the hint is outside the map
ERROR: (device loop0): remounting filesystem as read-only
BUG: Bad page state in process syz-executor184 pfn:78422
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2d pfn:0x78422
flags: 0xfff8000000800c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff8000000800c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002d ffff888020d448b8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5084, tgid 818872024 (syz-executor184), ts 5084, free_ts 71195067793
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
alloc_pages_mpol+0x3e8/0x680 mm/mempolicy.c:2264
alloc_pages mm/mempolicy.c:2335 [inline]
folio_alloc+0x128/0x180 mm/mempolicy.c:2342
filemap_alloc_folio+0xdf/0x500 mm/filemap.c:984
__filemap_get_folio+0x41a/0xbb0 mm/filemap.c:1926
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:93
find_or_create_page include/linux/pagemap.h:757 [inline]
grab_cache_page include/linux/pagemap.h:873 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225
vfs_mkdir+0x2fb/0x4b0 fs/namei.c:4123
do_mkdirat+0x264/0x3a0 fs/namei.c:4146
page last free pid 5075 tgid 5075 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
__folio_put_small mm/swap.c:119 [inline]
__folio_put+0x22b/0x390 mm/swap.c:142
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:224 [inline]
pipe_read+0x6f4/0x13e0 fs/pipe.c:344
call_read_iter include/linux/fs.h:2104 [inline]
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x97d/0xb70 fs/read_write.c:476
ksys_read+0x1a0/0x2c0 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor184 Not tainted 6.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:515
free_page_is_bad mm/page_alloc.c:968 [inline]
free_pages_prepare mm/page_alloc.c:1133 [inline]
free_unref_page_prepare+0xa51/0xab0 mm/page_alloc.c:2347
free_unref_folios+0x185/0xb30 mm/page_alloc.c:2536
folios_put_refs+0x8eb/0xa10 mm/swap.c:1034
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
jfs_remount+0x364/0x6b0 fs/jfs/super.c:451
reconfigure_super+0x447/0x880 fs/super.c:1071
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f592ecba6b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffed4e2efa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 00007ffed4e2f178 RCX: 00007f592ecba6b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000004
RBP: 00007f592ed33610 R08: 0000000000000000 R09: 00007ffed4e2f178
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffed4e2f168 R14: 0000000000000001 R15: 0000000000000001
BUG: Bad page state in process syz-executor184 pfn:78423
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2e pfn:0x78423
flags: 0xfff8000000800c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff8000000800c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002e ffff888020d449b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5084, tgid 818921403 (syz-executor184), ts 5084, free_ts 71195049084
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
alloc_pages_mpol+0x3e8/0x680 mm/mempolicy.c:2264
alloc_pages mm/mempolicy.c:2335 [inline]
folio_alloc+0x128/0x180 mm/mempolicy.c:2342
filemap_alloc_folio+0xdf/0x500 mm/filemap.c:984
__filemap_get_folio+0x41a/0xbb0 mm/filemap.c:1926
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:93
find_or_create_page include/linux/pagemap.h:757 [inline]
grab_cache_page include/linux/pagemap.h:873 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225
vfs_mkdir+0x2fb/0x4b0 fs/namei.c:4123
do_mkdirat+0x264/0x3a0 fs/namei.c:4146
page last free pid 5075 tgid 5075 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
__folio_put_small mm/swap.c:119 [inline]
__folio_put+0x22b/0x390 mm/swap.c:142
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:224 [inline]
pipe_read+0x6f4/0x13e0 fs/pipe.c:344
call_read_iter include/linux/fs.h:2104 [inline]
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x97d/0xb70 fs/read_write.c:476
ksys_read+0x1a0/0x2c0 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor184 Tainted: G B 6.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:515
free_page_is_bad mm/page_alloc.c:968 [inline]
free_pages_prepare mm/page_alloc.c:1133 [inline]
free_unref_page_prepare+0xa51/0xab0 mm/page_alloc.c:2347
free_unref_folios+0x185/0xb30 mm/page_alloc.c:2536
folios_put_refs+0x8eb/0xa10 mm/swap.c:1034
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
jfs_remount+0x364/0x6b0 fs/jfs/super.c:451
reconfigure_super+0x447/0x880 fs/super.c:1071
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f592ecba6b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffed4e2efa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 00007ffed4e2f178 RCX: 00007f592ecba6b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000004
RBP: 00007f592ed33610 R08: 0000000000000000 R09: 00007ffed4e2f178
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffed4e2f168 R14: 0000000000000001 R15: 0000000000000001
BUG: Bad page state in process syz-executor184 pfn:786c2
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2f pfn:0x786c2
flags: 0xfff8000000800c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff8000000800c dead000000000100 dead000000000122 0000000000000000
raw: 000000000000002f ffff888020d44aa8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5084, tgid 818968963 (syz-executor184), ts 5084, free_ts 71194885774
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
alloc_pages_mpol+0x3e8/0x680 mm/mempolicy.c:2264
alloc_pages mm/mempolicy.c:2335 [inline]
folio_alloc+0x128/0x180 mm/mempolicy.c:2342
filemap_alloc_folio+0xdf/0x500 mm/filemap.c:984
__filemap_get_folio+0x41a/0xbb0 mm/filemap.c:1926
pagecache_get_page+0x2c/0x200 mm/folio-compat.c:93
find_or_create_page include/linux/pagemap.h:757 [inline]
grab_cache_page include/linux/pagemap.h:873 [inline]
__get_metapage+0x2b4/0x1050 fs/jfs/jfs_metapage.c:613
diNewExt+0xacf/0x37e0 fs/jfs/jfs_imap.c:2272
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbec/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225
vfs_mkdir+0x2fb/0x4b0 fs/namei.c:4123
do_mkdirat+0x264/0x3a0 fs/namei.c:4146
page last free pid 5075 tgid 5075 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
__folio_put_small mm/swap.c:119 [inline]
__folio_put+0x22b/0x390 mm/swap.c:142
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
pipe_update_tail fs/pipe.c:224 [inline]
pipe_read+0x6f4/0x13e0 fs/pipe.c:344
call_read_iter include/linux/fs.h:2104 [inline]
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x97d/0xb70 fs/read_write.c:476
ksys_read+0x1a0/0x2c0 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor184 Tainted: G B 6.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:515
free_page_is_bad mm/page_alloc.c:968 [inline]
free_pages_prepare mm/page_alloc.c:1133 [inline]
free_unref_page_prepare+0xa51/0xab0 mm/page_alloc.c:2347
free_unref_folios+0x185/0xb30 mm/page_alloc.c:2536
folios_put_refs+0x8eb/0xa10 mm/swap.c:1034
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
jfs_remount+0x364/0x6b0 fs/jfs/super.c:451
reconfigure_super+0x447/0x880 fs/super.c:1071
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f592ecba6b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffed4e2efa8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 00007ffed4e2f178 RCX: 00007f592ecba6b9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000004
RBP: 00007f592ed33610 R08: 0000000000000000 R09: 00007ffed4e2f178
R10: 0000000000000000 R11: 0000000000000246 R12: 0000