blkno = 8ed2c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap: blocks are outside the map
ERROR: (device loop0): remounting filesystem as read-only
BUG: Bad page state in process jfsCommit  pfn:73f64
page:ffffea0001cfd900 refcount:0 mapcount:0 mapping:0000000000000000 index:0x24 pfn:0x73f64
flags: 0xfff00000002005(locked|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002005 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000024 ffff888073f633e0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 5019, ts 111134452760, free_ts 110170092079
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 __page_cache_alloc+0xce/0x440 mm/filemap.c:1022
 do_read_cache_page+0x1d4/0x1010 mm/filemap.c:3457
 read_mapping_page include/linux/pagemap.h:515 [inline]
 __get_metapage+0x35d/0x1060 fs/jfs/jfs_metapage.c:621
 diRead+0x6e6/0xbb0 fs/jfs/jfs_imap.c:367
 jfs_iget+0x89/0x3f0 fs/jfs/inode.c:35
 jfs_lookup+0x21d/0x420 fs/jfs/namei.c:1469
 __lookup_slow+0x29d/0x410 fs/namei.c:1671
 lookup_slow+0x53/0x70 fs/namei.c:1688
 walk_component+0x314/0x460 fs/namei.c:1984
 lookup_last fs/namei.c:2439 [inline]
 path_lookupat+0x148/0x420 fs/namei.c:2463
 filename_lookup+0x21e/0x550 fs/namei.c:2492
 user_path_at_empty+0x40/0x190 fs/namei.c:2891
 user_path_at include/linux/namei.h:57 [inline]
 path_setxattr+0xb3/0x290 fs/xattr.c:625
 __do_sys_lsetxattr fs/xattr.c:653 [inline]
 __se_sys_lsetxattr fs/xattr.c:649 [inline]
 __x64_sys_lsetxattr+0xb4/0xd0 fs/xattr.c:649
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 free_slab mm/slub.c:2020 [inline]
 discard_slab mm/slub.c:2026 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512
 put_cpu_partial+0x12d/0x190 mm/slub.c:2592
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc_trace+0x165/0x290 mm/slub.c:3250
 kmalloc include/linux/slab.h:607 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:643 [inline]
 netdevice_event+0x3ad/0x930 drivers/infiniband/core/roce_gid_mgmt.c:802
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391
 call_netdevice_notifiers_extack net/core/dev.c:2074 [inline]
 call_netdevice_notifiers net/core/dev.c:2088 [inline]
 unregister_netdevice_many+0x109b/0x1a40 net/core/dev.c:11160
 default_device_exit_batch+0x364/0x3c0 net/core/dev.c:11693
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x78e/0xba0 net/core/net_namespace.c:635
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
Modules linked in:
CPU: 1 PID: 276 Comm: jfsCommit Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 bad_page+0x14b/0x170 mm/page_alloc.c:652
 check_free_page mm/page_alloc.c:1209 [inline]
 free_pages_prepare mm/page_alloc.c:1334 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x383/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 txUnlock+0x275/0xcb0 fs/jfs/jfs_txnmgr.c:933
 txLazyCommit fs/jfs/jfs_txnmgr.c:2717 [inline]
 jfs_lazycommit+0x598/0xb60 fs/jfs/jfs_txnmgr.c:2767
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
page:ffffea0001cfd900 refcount:0 mapcount:0 mapping:0000000000000000 index:0x24 pfn:0x73f64
flags: 0xfff00000002005(locked|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002005 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000024 ffff888073f633e0 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x100c40(GFP_NOFS|__GFP_HARDWALL), pid 5019, ts 111134452760, free_ts 110170092079
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 __page_cache_alloc+0xce/0x440 mm/filemap.c:1022
 do_read_cache_page+0x1d4/0x1010 mm/filemap.c:3457
 read_mapping_page include/linux/pagemap.h:515 [inline]
 __get_metapage+0x35d/0x1060 fs/jfs/jfs_metapage.c:621
 diRead+0x6e6/0xbb0 fs/jfs/jfs_imap.c:367
 jfs_iget+0x89/0x3f0 fs/jfs/inode.c:35
 jfs_lookup+0x21d/0x420 fs/jfs/namei.c:1469
 __lookup_slow+0x29d/0x410 fs/namei.c:1671
 lookup_slow+0x53/0x70 fs/namei.c:1688
 walk_component+0x314/0x460 fs/namei.c:1984
 lookup_last fs/namei.c:2439 [inline]
 path_lookupat+0x148/0x420 fs/namei.c:2463
 filename_lookup+0x21e/0x550 fs/namei.c:2492
 user_path_at_empty+0x40/0x190 fs/namei.c:2891
 user_path_at include/linux/namei.h:57 [inline]
 path_setxattr+0xb3/0x290 fs/xattr.c:625
 __do_sys_lsetxattr fs/xattr.c:653 [inline]
 __se_sys_lsetxattr fs/xattr.c:649 [inline]
 __x64_sys_lsetxattr+0xb4/0xd0 fs/xattr.c:649
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 free_slab mm/slub.c:2020 [inline]
 discard_slab mm/slub.c:2026 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512
 put_cpu_partial+0x12d/0x190 mm/slub.c:2592
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc_trace+0x165/0x290 mm/slub.c:3250
 kmalloc include/linux/slab.h:607 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:643 [inline]
 netdevice_event+0x3ad/0x930 drivers/infiniband/core/roce_gid_mgmt.c:802
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391
 call_netdevice_notifiers_extack net/core/dev.c:2074 [inline]
 call_netdevice_notifiers net/core/dev.c:2088 [inline]
 unregister_netdevice_many+0x109b/0x1a40 net/core/dev.c:11160
 default_device_exit_batch+0x364/0x3c0 net/core/dev.c:11693
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x78e/0xba0 net/core/net_namespace.c:635
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1224!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 276 Comm: jfsCommit Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:get_page include/linux/mm.h:1224 [inline]
RIP: 0010:put_metapage+0x26d/0x270 fs/jfs/jfs_metapage.c:722
Code: 38 c1 0f 8c ff fe ff ff 4c 89 ef e8 fd c7 ec fe e9 f2 fe ff ff e8 43 a5 a7 fe 48 8b 3c 24 48 c7 c6 20 3a 62 8a e8 43 8a da fe <0f> 0b 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 49 bc
RSP: 0018:ffffc90002d0fcf0 EFLAGS: 00010246
RAX: 1889d1ef73672300 RBX: ffff888073f633e0 RCX: 0000000000000000
RDX: 0000000000000044 RSI: 0000000000000000 RDI: fffff520005a1f90
RBP: 000000000000007f R08: ffff8880b9033d7f R09: fffff520005a1f4c
R10: dffffc0000000000 R11: ffffed10172067b0 R12: ffff888073f63408
R13: ffffea0001cfd934 R14: 1ffff1100e7ec681 R15: 1ffff1100e7ec68e
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000019c2a952f000 CR3: 000000002aef6000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 txUnlock+0x426/0xcb0 fs/jfs/jfs_txnmgr.c:948
 txLazyCommit fs/jfs/jfs_txnmgr.c:2717 [inline]
 jfs_lazycommit+0x598/0xb60 fs/jfs/jfs_txnmgr.c:2767
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
---[ end trace 2819a93bcba32360 ]---
RIP: 0010:get_page include/linux/mm.h:1224 [inline]
RIP: 0010:put_metapage+0x26d/0x270 fs/jfs/jfs_metapage.c:722
Code: 38 c1 0f 8c ff fe ff ff 4c 89 ef e8 fd c7 ec fe e9 f2 fe ff ff e8 43 a5 a7 fe 48 8b 3c 24 48 c7 c6 20 3a 62 8a e8 43 8a da fe <0f> 0b 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 49 bc
RSP: 0018:ffffc90002d0fcf0 EFLAGS: 00010246
RAX: 1889d1ef73672300 RBX: ffff888073f633e0 RCX: 0000000000000000
RDX: 0000000000000044 RSI: 0000000000000000 RDI: fffff520005a1f90
RBP: 000000000000007f R08: ffff8880b9033d7f R09: fffff520005a1f4c
R10: dffffc0000000000 R11: ffffed10172067b0 R12: ffff888073f63408
R13: ffffea0001cfd934 R14: 1ffff1100e7ec681 R15: 1ffff1100e7ec68e
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000019c2a952f000 CR3: 000000007e20e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400