io_mem_free.part.0+0xcc/0xd5 fs/io_uring.c:8841
 io_mem_free fs/io_uring.c:8836 [inline]
 io_ring_ctx_free fs/io_uring.c:9383 [inline]
 io_ring_exit_work+0xa64/0xbe8 fs/io_uring.c:9535
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2299
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2446
 kthread+0x405/0x4f0 kernel/kthread.c:345
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
------------[ cut here ]------------
kernel BUG at mm/page_alloc.c:1083!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 22468 Comm: syz-executor.0 Not tainted 5.16.0-rc2-next-20211125-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__free_one_page+0xa8a/0xf60 mm/page_alloc.c:1083
Code: 43 34 85 c0 0f 84 f4 f8 ff ff 48 c7 c6 40 62 b7 89 48 89 ef e8 77 cd f5 ff 0f 0b 48 c7 c6 20 61 b7 89 4c 89 ef e8 66 cd f5 ff <0f> 0b 0f 0b 48 c7 c6 80 61 b7 89 4c 89 ef e8 53 cd f5 ff 0f 0b 48
RSP: 0018:ffffc9000be0f3d0 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffc9000be0f4c8 RCX: 0000000000000000
RDX: ffff888020d2ba80 RSI: ffffffff81b72aba RDI: 0000000000000003
RBP: 0000000000089a00 R08: 0000000000000018 R09: 00000000ffffffff
R10: ffffffff890d0438 R11: 00000000ffffffff R12: 0000000000000009
R13: ffffea0002268000 R14: 0000000000000000 R15: ffff88813fffa700
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f22145c01b8 CR3: 000000007f05b000 CR4: 00000000003526e0
Call Trace:
 <TASK>
 free_pcppages_bulk+0x533/0x8a0 mm/page_alloc.c:1545
 free_unref_page_commit.constprop.0+0x4cf/0x6f0 mm/page_alloc.c:3390
 free_unref_page+0x236/0x690 mm/page_alloc.c:3423
 release_pages+0x82a/0x1b30 mm/swap.c:956
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
 tlb_flush_mmu+0xe9/0x6b0 mm/mmu_gather.c:249
 zap_pte_range mm/memory.c:1418 [inline]
 zap_pmd_range mm/memory.c:1467 [inline]
 zap_pud_range mm/memory.c:1496 [inline]
 zap_p4d_range mm/memory.c:1517 [inline]
 unmap_page_range+0x1ea3/0x32e0 mm/memory.c:1538
 unmap_single_vma+0x198/0x310 mm/memory.c:1583
 unmap_vmas+0x16b/0x2f0 mm/memory.c:1615
 exit_mmap+0x1d0/0x630 mm/mmap.c:3176
 __mmput+0x122/0x4b0 kernel/fork.c:1115
 mmput+0x56/0x60 kernel/fork.c:1136
 exit_mm kernel/exit.c:507 [inline]
 do_exit+0xb27/0x2c20 kernel/exit.c:819
 do_group_exit+0x125/0x310 kernel/exit.c:929
 get_signal+0x34c/0x28b0 kernel/signal.c:2859
 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
RIP: 0033:0x7f9fb0a3ff41
Code: Unable to access opcode bytes at RIP 0x7f9fb0a3ff17.
RSP: 002b:00007f9faf9302f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 00007f9faf930700 RCX: 00007f9fb0a3ff41
RDX: 00007f9faf9309d0 RSI: 00007f9faf9302f0 RDI: 00000000003d0f00
RBP: 00007ffe747fb940 R08: 00007f9faf930700 R09: 00007f9faf930700
R10: 00007f9faf9309d0 R11: 0000000000000206 R12: 00007ffe747fb7be
R13: 00007ffe747fb7bf R14: 00007f9faf930300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 74075edfb47956a1 ]---
RIP: 0010:__free_one_page+0xa8a/0xf60 mm/page_alloc.c:1083
Code: 43 34 85 c0 0f 84 f4 f8 ff ff 48 c7 c6 40 62 b7 89 48 89 ef e8 77 cd f5 ff 0f 0b 48 c7 c6 20 61 b7 89 4c 89 ef e8 66 cd f5 ff <0f> 0b 0f 0b 48 c7 c6 80 61 b7 89 4c 89 ef e8 53 cd f5 ff 0f 0b 48
RSP: 0018:ffffc9000be0f3d0 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffc9000be0f4c8 RCX: 0000000000000000
RDX: ffff888020d2ba80 RSI: ffffffff81b72aba RDI: 0000000000000003
RBP: 0000000000089a00 R08: 0000000000000018 R09: 00000000ffffffff
R10: ffffffff890d0438 R11: 00000000ffffffff R12: 0000000000000009
R13: ffffea0002268000 R14: 0000000000000000 R15: ffff88813fffa700
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f22145c01b8 CR3: 000000007f05b000 CR4: 00000000003526e0