BUG: Bad page state in process syz.2.26 pfn:2a5d8 page:ffffea0000a97600 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x2a5d8 flags: 0xfff08000002046(referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff08000002046 ffffea0001d865c8 ffffc900037379a0 0000000000000000 raw: 000000000000001c ffff88805c5935d0 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 4558, tgid 4557 (syz.2.26), ts 106390136477, free_ts 106364769222 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560 prep_new_page mm/page_alloc.c:2567 [inline] get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292 filemap_alloc_folio+0xdb/0x480 mm/filemap.c:999 do_read_cache_folio+0x1b9/0x790 mm/filemap.c:3623 do_read_cache_page+0x32/0x230 mm/filemap.c:3701 read_mapping_page include/linux/pagemap.h:793 [inline] __get_metapage+0x319/0xfb0 fs/jfs/jfs_metapage.c:620 diRead+0x6e6/0xbb0 fs/jfs/jfs_imap.c:367 jfs_iget+0x89/0x3f0 fs/jfs/inode.c:35 jfs_fill_super+0x6f8/0xab0 fs/jfs/super.c:580 mount_bdev+0x28a/0x3c0 fs/super.c:1443 legacy_get_tree+0xe6/0x180 fs/fs_context.c:632 vfs_get_tree+0x88/0x270 fs/super.c:1573 do_new_mount+0x247/0xa40 fs/namespace.c:3078 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3606 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1487 [inline] free_pcp_prepare mm/page_alloc.c:1537 [inline] free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737 slab_alloc_node mm/slub.c:3359 [inline] slab_alloc mm/slub.c:3367 [inline] __kmem_cache_alloc_lru mm/slub.c:3374 [inline] kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3383 getname_flags+0xb7/0x500 fs/namei.c:139 user_path_at_empty+0x28/0x60 fs/namei.c:2912 do_readlinkat+0xd9/0x490 fs/stat.c:468 __do_sys_readlink fs/stat.c:501 [inline] __se_sys_readlink fs/stat.c:498 [inline] __x64_sys_readlink+0x7b/0x90 fs/stat.c:498 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Modules linked in: CPU: 0 PID: 4571 Comm: syz.2.26 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:726 free_page_is_bad mm/page_alloc.c:1318 [inline] free_pages_prepare mm/page_alloc.c:1479 [inline] free_pcp_prepare mm/page_alloc.c:1537 [inline] free_unref_page_prepare+0x447/0x9e0 mm/page_alloc.c:3414 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3555 release_pages+0x20d1/0x2340 mm/swap.c:1035 __pagevec_release+0x6d/0xe0 mm/swap.c:1055 pagevec_release include/linux/pagevec.h:71 [inline] folio_batch_release include/linux/pagevec.h:135 [inline] truncate_inode_pages_range+0x35c/0x10b0 mm/truncate.c:397 jfs_remount+0x348/0x5c0 fs/jfs/super.c:451 reconfigure_super+0x224/0x8d0 fs/super.c:977 do_remount fs/namespace.c:2741 [inline] path_mount+0xcce/0xfb0 fs/namespace.c:3400 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3606 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f2e74f9f10a Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2e745dce58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f2e745dcee0 RCX: 00007f2e74f9f10a RDX: 0000200000000f40 RSI: 0000200000000f00 RDI: 0000000000000000 RBP: 0000200000000f40 R08: 00007f2e745dcee0 R09: 0000000001a6a038 R10: 0000000001a6a038 R11: 0000000000000246 R12: 0000200000000f00 R13: 00007f2e745dcea0 R14: 0000000000000000 R15: 0000200000002cc0