Extracting prog: 5m10.443661509s Minimizing prog: 1h37m7.128822638s Simplifying prog options: 0s Extracting C: 1m32.358404959s Simplifying C: 24m39.778795653s 1 programs, timeouts [45s 5m0s 16m0s] extracting reproducer from 1 programs single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program crashed: BUG: Bad page cache in process syz.NUM.NUM pfn:4e787 single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) dup(r0) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r0 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r0, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r0, 0x409, 0x7) r1 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000140)={r0, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r1, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) pwrite64(0xffffffffffffffff, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r1 = dup(r0) r2 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r2, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r0, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r0, 0x409, 0x7) r1 = dup(0xffffffffffffffff) r2 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={r0, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r2, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(0x0, 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, 0x0, 0x0, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0), 0x0, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r1, 0x0, 0x0, 0x4000}) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap detailed listing: executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r1 = memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) pwrite64(r1, &(0x7f00000000c0)="a0", 0x1, 0x5b63) fcntl$addseals(r1, 0x409, 0x7) r2 = dup(r0) r3 = ioctl$UDMABUF_CREATE(r2, 0x40187542, 0x0) mmap(&(0x7f00009a0000/0x2000)=nil, 0x2000, 0x2000009, 0x28011, r3, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map simplifying C reproducer testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program did not crash testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$udambuf-memfd_create-pwrite64-fcntl$addseals-dup-ioctl$UDMABUF_CREATE-mmap program crashed: BUG: Bad page map reproducing took 2h8m29.709723818s repro crashed as (corrupted=false): BUG: Bad page cache in process syz-executor356 pfn:ba081 page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc01cd7c8 ffffc1ffc1e86288 f9f000000749ba50 raw: 0000000000000000 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page cache in process syz-executor356 pfn:ba18a page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc1e82048 ffffc1ffc028a2c8 f9f000000749ba50 raw: 0000000000000001 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba0818c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc028c708 ffffc1ffc1e86288 0000000000000000 raw: 0000000000000000 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a0000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:0 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba18a8c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc1e82048 ffffc1ffc028a2c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a1000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:1 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba081 page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba18a page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 final repro crashed as (corrupted=false): BUG: Bad page cache in process syz-executor356 pfn:ba081 page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc01cd7c8 ffffc1ffc1e86288 f9f000000749ba50 raw: 0000000000000000 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page cache in process syz-executor356 pfn:ba18a page: refcount:4 mapcount:1 mapping:000000000e551739 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 aops:shmem_aops ino:3 flags: 0x1ffc0000004002d(locked|referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002d ffffc1ffc1e82048 ffffc1ffc028a2c8 f9f000000749ba50 raw: 0000000000000001 0000000000000000 0000000400000000 f7f0000002c3a000 page dumped because: still mapped when deleted CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 filemap_unaccount_folio+0x118/0x278 mm/filemap.c:167 __filemap_remove_folio+0x3c/0x178 mm/filemap.c:231 filemap_remove_folio+0x48/0xa8 mm/filemap.c:264 truncate_inode_folio+0x30/0x4c mm/truncate.c:195 shmem_undo_range+0x208/0x620 mm/shmem.c:1012 shmem_truncate_range mm/shmem.c:1125 [inline] shmem_evict_inode+0x130/0x2dc mm/shmem.c:1253 evict+0xb4/0x198 fs/inode.c:667 iput_final fs/inode.c:1741 [inline] iput fs/inode.c:1767 [inline] iput+0x100/0x1b8 fs/inode.c:1753 dentry_unlink_inode+0xc0/0x188 fs/dcache.c:404 __dentry_kill+0x7c/0x1d4 fs/dcache.c:607 dput.part.0+0x30/0xbc fs/dcache.c:849 dput+0x4c/0x50 fs/dcache.c:860 __fput+0x110/0x2d4 fs/file_table.c:430 __fput_sync+0x50/0x5c fs/file_table.c:507 __do_sys_close fs/open.c:1563 [inline] __se_sys_close fs/open.c:1548 [inline] __arm64_sys_close+0x38/0x7c fs/open.c:1548 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba0818c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc028c708 ffffc1ffc1e86288 0000000000000000 raw: 0000000000000000 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a0000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:0 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page map in process syz-executor356 pte:600000ba18a8c3 pmd:800000047670003 page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a memcg:f7f0000002c3a000 flags: 0x1ffc0000004002c(referenced|uptodate|lru|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004002c ffffc1ffc1e82048 ffffc1ffc028a2c8 0000000000000000 raw: 0000000000000001 0000000000000000 00000001fffffffe f7f0000002c3a000 page dumped because: bad pte addr:00000000209a1000 vm_flags:400000f9 anon_vma:0000000000000000 mapping:f3f0000006dcee48 index:1 file:dmabuf fault:udmabuf_vm_fault mmap:dma_buf_mmap_internal read_folio:0x0 CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 print_bad_pte+0x1c8/0x258 mm/memory.c:538 zap_present_folio_ptes mm/memory.c:1508 [inline] zap_present_ptes mm/memory.c:1564 [inline] zap_pte_range mm/memory.c:1606 [inline] zap_pmd_range mm/memory.c:1724 [inline] zap_pud_range mm/memory.c:1753 [inline] zap_p4d_range mm/memory.c:1774 [inline] unmap_page_range+0x904/0x1190 mm/memory.c:1795 unmap_single_vma.constprop.0+0x4c/0x84 mm/memory.c:1841 unmap_vmas+0x7c/0x170 mm/memory.c:1885 exit_mmap+0xc0/0x288 mm/mmap.c:3341 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba081 page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x0 pfn:0xba081 flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 BUG: Bad page state in process syz-executor356 pfn:ba18a page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0xba18a flags: 0x1ffc0000004000c(referenced|uptodate|swapbacked|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) raw: 01ffc0000004000c dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 0 PID: 3196 Comm: syz-executor356 Tainted: G B 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:317 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:114 dump_stack+0x18/0x24 lib/dump_stack.c:123 bad_page+0x84/0x11c mm/page_alloc.c:498 free_page_is_bad_report+0x98/0xa4 mm/page_alloc.c:904 free_page_is_bad mm/page_alloc.c:914 [inline] free_pages_prepare mm/page_alloc.c:1085 [inline] free_unref_folios+0x4c0/0x624 mm/page_alloc.c:2637 folios_put_refs+0x108/0x284 mm/swap.c:1024 free_pages_and_swap_cache+0x14c/0x164 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0x4c/0xdc mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x84/0x200 mm/mmu_gather.c:465 exit_mmap+0x13c/0x288 mm/mmap.c:3354 __mmput+0x3c/0x170 kernel/fork.c:1346 mmput+0x50/0x5c kernel/fork.c:1368 exit_mm kernel/exit.c:567 [inline] do_exit+0x270/0x98c kernel/exit.c:863 do_group_exit+0x34/0x90 kernel/exit.c:1025 __do_sys_exit_group kernel/exit.c:1036 [inline] __se_sys_exit_group kernel/exit.c:1034 [inline] pid_child_should_wake+0x0/0x5c kernel/exit.c:1034 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:131 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:150 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598