BUG: Bad page state in process syz-executor339 pfn:781cf
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x781cf
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff888045cfe6c8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5079, tgid 5079 (syz-executor339), ts 60358478391, free_ts 60350734150
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 5079 tgid 5079 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:2502e
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x2502e
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff888045cfe5d0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5079, tgid 5079 (syz-executor339), ts 60357642186, free_ts 60350739807
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5079 tgid 5079 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:45d78
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x45d78
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff888045cfeaa8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5081, tgid 5081 (syz-executor339), ts 61856500441, free_ts 61855057062
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 5081 tgid 5081 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:47a80
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x47a80
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff888045cfe9b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5081, tgid 5081 (syz-executor339), ts 61856273986, free_ts 61855061211
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5081 tgid 5081 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:2c836
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x2c836
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff88802458ec98 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5082, tgid 5082 (syz-executor339), ts 63329628076, free_ts 63318671388
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 5082 tgid 5082 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:45d06
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x45d06
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff88802458eba0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5082, tgid 5082 (syz-executor339), ts 63329267790, free_ts 63318676055
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5082 tgid 5082 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:23f3f
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x23f3f
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff8880228c6e88 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5083, tgid 5083 (syz-executor339), ts 64781263661, free_ts 64780730224
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 5083 tgid 5083 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
skb_free_frag include/linux/skbuff.h:3354 [inline]
skb_free_head net/core/skbuff.c:1079 [inline]
skb_release_data+0x6b2/0x880 net/core/skbuff.c:1108
skb_release_all net/core/skbuff.c:1173 [inline]
__kfree_skb+0x55/0x70 net/core/skbuff.c:1187
tcp_rcv_established+0x10a2/0x2020 net/ipv4/tcp_input.c:6087
tcp_v4_do_rcv+0x965/0xc60 net/ipv4/tcp_ipv4.c:1914
tcp_v4_rcv+0x2d90/0x37b0 net/ipv4/tcp_ipv4.c:2350
ip_protocol_deliver_rcu+0x225/0x430 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x33f/0x5f0 net/ipv4/ip_input.c:233
NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
ip_local_deliver net/ipv4/ip_input.c:254 [inline]
dst_input include/net/dst.h:460 [inline]
ip_sublist_rcv_finish+0x3be/0x4f0 net/ipv4/ip_input.c:580
ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline]
ip_sublist_rcv+0x75d/0xab0 net/ipv4/ip_input.c:639
ip_list_rcv+0x42b/0x480 net/ipv4/ip_input.c:674
__netif_receive_skb_list_ptype net/core/dev.c:5667 [inline]
__netif_receive_skb_list_core+0x95a/0x980 net/core/dev.c:5715
__netif_receive_skb_list net/core/dev.c:5767 [inline]
netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5859
gro_normal_list include/net/gro.h:515 [inline]
napi_complete_done+0x310/0x8e0 net/core/dev.c:6202
virtqueue_napi_complete drivers/net/virtio_net.c:655 [inline]
virtnet_poll+0xd68/0x18c0 drivers/net/virtio_net.c:2370
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:462d4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x462d4
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff8880228c6d90 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5083, tgid 5083 (syz-executor339), ts 64780541829, free_ts 64769800667
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5083 tgid 5083 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:26f0a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x26f0a
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff88801f0a2aa8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5084, tgid 5084 (syz-executor339), ts 66353205281, free_ts 66099246953
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 4534 tgid 4534 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
discard_slab mm/slub.c:2526 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2994
put_cpu_partial+0x17c/0x250 mm/slub.c:3069
__slab_free+0x2ea/0x3d0 mm/slub.c:4306
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]
__do_kmalloc_node mm/slub.c:4120 [inline]
__kmalloc_noprof+0x1a3/0x400 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x740 security/tomoyo/file.c:822
security_inode_getattr+0xd8/0x130 security/security.c:2269
vfs_getattr+0x45/0x430 fs/stat.c:173
vfs_fstat fs/stat.c:198 [inline]
vfs_fstatat+0xd6/0x190 fs/stat.c:300
__do_sys_newfstatat fs/stat.c:468 [inline]
__se_sys_newfstatat fs/stat.c:462 [inline]
__x64_sys_newfstatat+0x125/0x1b0 fs/stat.c:462
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:26f09
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x26f09
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff88801f0a29b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5084, tgid 5084 (syz-executor339), ts 66352923501, free_ts 66099246953
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 4534 tgid 4534 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
discard_slab mm/slub.c:2526 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2994
put_cpu_partial+0x17c/0x250 mm/slub.c:3069
__slab_free+0x2ea/0x3d0 mm/slub.c:4306
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]
__do_kmalloc_node mm/slub.c:4120 [inline]
__kmalloc_noprof+0x1a3/0x400 mm/slub.c:4134
kmalloc_noprof include/linux/slab.h:664 [inline]
tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x740 security/tomoyo/file.c:822
security_inode_getattr+0xd8/0x130 security/security.c:2269
vfs_getattr+0x45/0x430 fs/stat.c:173
vfs_fstat fs/stat.c:198 [inline]
vfs_fstatat+0xd6/0x190 fs/stat.c:300
__do_sys_newfstatat fs/stat.c:468 [inline]
__se_sys_newfstatat fs/stat.c:462 [inline]
__x64_sys_newfstatat+0x125/0x1b0 fs/stat.c:462
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:1e7d7
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x1e7d7
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff88801151caa8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5085, tgid 5085 (syz-executor339), ts 67845661743, free_ts 67843462035
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 0 tgid 0 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 1 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:234fa
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x234fa
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff88801151c9b0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5085, tgid 5085 (syz-executor339), ts 67845289695, free_ts 67843478213
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 0 tgid 0 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 1 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:24f75
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x24f75
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000003 ffff88802d484c98 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5086, tgid 5086 (syz-executor339), ts 69347570402, free_ts 69346489860
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAdjCtl+0x138/0x9c0 fs/jfs/jfs_dmap.c:2481
dbAllocDmap fs/jfs/jfs_dmap.c:2042 [inline]
dbAllocDmapLev+0x29c/0x4a0 fs/jfs/jfs_dmap.c:1986
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1823
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
page last free pid 5086 tgid 5086 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff46e01150
RBP: 00007fff46e01150 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fff46e021c0
R13: 0000555570a856c0 R14: 431bde82d7b634db R15: 00007fff46e021e0
BUG: Bad page state in process syz-executor339 pfn:1bab6
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x1bab6
flags: 0xfff0000000400c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff0000000400c dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000004 ffff88802d484ba0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5086, tgid 5086 (syz-executor339), ts 69347299993, free_ts 69346498294
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2336 [inline]
folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2343
filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1008
do_read_cache_folio+0xed/0x820 mm/filemap.c:3752
do_read_cache_page+0x30/0x200 mm/filemap.c:3854
read_mapping_page include/linux/pagemap.h:896 [inline]
__get_metapage+0x330/0x1050 fs/jfs/jfs_metapage.c:620
dbAllocCtl+0xd5/0x920 fs/jfs/jfs_dmap.c:1816
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa10 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100
jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5086 tgid 5086 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
mapping_try_invalidate+0x4d4/0x620 mm/truncate.c:526
reconfigure_super+0x5dd/0x880 fs/super.c:1095
vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
vfs_fsconfig_locked fs/fsopen.c:296 [inline]
__do_sys_fsconfig fs/fsopen.c:476 [inline]
__se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 PID: 5078 Comm: syz-executor339 Tainted: G B 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
bad_page+0x14c/0x170 mm/page_alloc.c:498
free_page_is_bad mm/page_alloc.c:909 [inline]
free_pages_prepare mm/page_alloc.c:1080 [inline]
free_unref_folios+0x1121/0x19c0 mm/page_alloc.c:2614
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
folio_batch_release include/linux/pagevec.h:101 [inline]
truncate_inode_pages_range+0x47b/0xfc0 mm/truncate.c:362
dbUnmount+0x115/0x190 fs/jfs/jfs_dmap.c:275
jfs_umount+0x238/0x3a0 fs/jfs/jfs_umount.c:87
jfs_put_super+0x8a/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1676
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7647654c7
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff46e01098 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd7647654c7