BUG: Bad page state in process syz-executor590  pfn:1d4578
page:ffffea0007515e00 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000
page dumped because: nonzero _refcount
Modules linked in:
CPU: 1 PID: 1890 Comm: syz-executor590 Tainted: G        W         5.4.24-syzkaller-00181-g3334f0da669e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b0/0x228 lib/dump_stack.c:118
 bad_page+0x262/0x290 mm/page_alloc.c:661
 check_new_page_bad mm/page_alloc.c:2080 [inline]
 check_new_page mm/page_alloc.c:2092 [inline]
 check_new_pages mm/page_alloc.c:2145 [inline]
 rmqueue mm/page_alloc.c:3296 [inline]
 get_page_from_freelist+0x505a/0x57e0 mm/page_alloc.c:3693
 ? 0xffffffffa0010000
 __alloc_pages_nodemask+0x44f/0x3010 mm/page_alloc.c:4757
 __alloc_pages include/linux/gfp.h:496 [inline]
 __alloc_pages_node include/linux/gfp.h:509 [inline]
 alloc_pages_node include/linux/gfp.h:523 [inline]
 skb_page_frag_refill+0x11d/0x3b0 net/core/sock.c:2376
 tun_build_skb drivers/net/tun.c:1677 [inline]
 tun_get_user+0x69a/0x3d10 drivers/net/tun.c:1818
 tun_chr_write_iter+0x134/0x1c0 drivers/net/tun.c:2026
 do_iter_readv_writev+0x5fa/0x890 include/linux/fs.h:1919
 do_iter_write+0x180/0x590 fs/read_write.c:973
 vfs_writev fs/read_write.c:1018 [inline]
 do_writev+0x2cd/0x560 fs/read_write.c:1061
 __do_sys_writev fs/read_write.c:1134 [inline]
 __se_sys_writev fs/read_write.c:1131 [inline]
 __x64_sys_writev+0x7d/0x90 fs/read_write.c:1131
 do_syscall_64+0xc0/0x100 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441e40
Code: 05 48 3d 01 f0 ff ff 0f 83 5d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d b1 91 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 34 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00
RSP: 002b:00007ffdfc085188 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007ffdfc0851a0 RCX: 0000000000441e40
RDX: 0000000000000001 RSI: 00007ffdfc0851d0 RDI: 00000000000000f0
RBP: 0000000000000000 R08: 00000000bb1414ac R09: 00000000bb1414ac
R10: 00000000bb1414ac R11: 0000000000000246 R12: 000000000000820a
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000