BUG: Bad page state in process jfsCommit  pfn:10daa2
page:ffffea000436a880 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x10daa2
flags: 0x200000000002047(locked|referenced|uptodate|workingset|private|node=0|zone=2)
raw: 0200000000002047 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff8881042ab000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 2829, tgid 2828 (syz-executor.0), ts 49638898323, free_ts 46897049886
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x13c/0x160 mm/page_alloc.c:2513
 prep_new_page mm/page_alloc.c:2520 [inline]
 get_page_from_freelist+0x10f4/0x12c0 mm/page_alloc.c:4279
 __alloc_pages+0x11b/0x270 mm/page_alloc.c:5545
 filemap_alloc_folio+0x5a/0x2d0 mm/filemap.c:971
 do_read_cache_folio+0x175/0x530 mm/filemap.c:3562
 do_read_cache_page+0x30/0x160 mm/filemap.c:3640
 read_mapping_page include/linux/pagemap.h:791 [inline]
 __get_metapage+0x16c/0x890 fs/jfs/jfs_metapage.c:620
 diRead+0x24d/0x380 fs/jfs/jfs_imap.c:364
 jfs_iget+0x60/0x190 fs/jfs/inode.c:35
 jfs_fill_super+0x316/0x4a0 fs/jfs/super.c:580
 mount_bdev+0x197/0x220 fs/super.c:1432
 legacy_get_tree+0x2c/0x70 fs/fs_context.c:632
 vfs_get_tree+0x2b/0xc0 fs/super.c:1562
 do_new_mount+0x1e4/0x550 fs/namespace.c:3051
 do_mount fs/namespace.c:3394 [inline]
 __do_sys_mount fs/namespace.c:3602 [inline]
 __se_sys_mount+0x283/0x2d0 fs/namespace.c:3579
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1440 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0x52b/0x5b0 mm/page_alloc.c:3358
 free_unref_page_list+0x7b/0x3a0 mm/page_alloc.c:3499
 release_pages+0x14ea/0x17c0 mm/swap.c:1055
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu+0x22e/0x280 mm/mmu_gather.c:261
 tlb_finish_mmu+0x55/0xa0 mm/mmu_gather.c:361
 exit_mmap+0x2c5/0x5e0 mm/mmap.c:3239
 __mmput+0x72/0x1a0 kernel/fork.c:1199
 exit_mm+0xcc/0x160 kernel/exit.c:563
 do_exit+0x37a/0x1060 kernel/exit.c:856
 do_group_exit+0xdc/0xe0 kernel/exit.c:1019
 __do_sys_exit_group kernel/exit.c:1030 [inline]
 __se_sys_exit_group kernel/exit.c:1028 [inline]
 __x64_sys_exit_group+0xe/0x10 kernel/exit.c:1028
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Modules linked in:
CPU: 1 PID: 75 Comm: jfsCommit Not tainted 6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xf0/0x176 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:699
 free_page_is_bad_report mm/page_alloc.c:1277 [inline]
 free_page_is_bad mm/page_alloc.c:1287 [inline]
 free_pages_prepare mm/page_alloc.c:1433 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0x234/0x5b0 mm/page_alloc.c:3358
 free_unref_page+0x33/0x260 mm/page_alloc.c:3453
 folio_put include/linux/mm.h:1167 [inline]
 put_page include/linux/mm.h:1219 [inline]
 _metapage_homeok fs/jfs/jfs_metapage.h:119 [inline]
 txUnlock+0x1d0/0x710 fs/jfs/jfs_txnmgr.c:932
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x22a/0x480 fs/jfs/jfs_txnmgr.c:2732
 kthread+0xf5/0x120 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>
page:ffffea000436a880 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x10daa2
flags: 0x200000000002047(locked|referenced|uptodate|workingset|private|node=0|zone=2)
raw: 0200000000002047 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff8881042ab000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 2829, tgid 2828 (syz-executor.0), ts 49638898323, free_ts 46897049886
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x13c/0x160 mm/page_alloc.c:2513
 prep_new_page mm/page_alloc.c:2520 [inline]
 get_page_from_freelist+0x10f4/0x12c0 mm/page_alloc.c:4279
 __alloc_pages+0x11b/0x270 mm/page_alloc.c:5545
 filemap_alloc_folio+0x5a/0x2d0 mm/filemap.c:971
 do_read_cache_folio+0x175/0x530 mm/filemap.c:3562
 do_read_cache_page+0x30/0x160 mm/filemap.c:3640
 read_mapping_page include/linux/pagemap.h:791 [inline]
 __get_metapage+0x16c/0x890 fs/jfs/jfs_metapage.c:620
 diRead+0x24d/0x380 fs/jfs/jfs_imap.c:364
 jfs_iget+0x60/0x190 fs/jfs/inode.c:35
 jfs_fill_super+0x316/0x4a0 fs/jfs/super.c:580
 mount_bdev+0x197/0x220 fs/super.c:1432
 legacy_get_tree+0x2c/0x70 fs/fs_context.c:632
 vfs_get_tree+0x2b/0xc0 fs/super.c:1562
 do_new_mount+0x1e4/0x550 fs/namespace.c:3051
 do_mount fs/namespace.c:3394 [inline]
 __do_sys_mount fs/namespace.c:3602 [inline]
 __se_sys_mount+0x283/0x2d0 fs/namespace.c:3579
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1440 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0x52b/0x5b0 mm/page_alloc.c:3358
 free_unref_page_list+0x7b/0x3a0 mm/page_alloc.c:3499
 release_pages+0x14ea/0x17c0 mm/swap.c:1055
 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
 tlb_flush_mmu+0x22e/0x280 mm/mmu_gather.c:261
 tlb_finish_mmu+0x55/0xa0 mm/mmu_gather.c:361
 exit_mmap+0x2c5/0x5e0 mm/mmap.c:3239
 __mmput+0x72/0x1a0 kernel/fork.c:1199
 exit_mm+0xcc/0x160 kernel/exit.c:563
 do_exit+0x37a/0x1060 kernel/exit.c:856
 do_group_exit+0xdc/0xe0 kernel/exit.c:1019
 __do_sys_exit_group kernel/exit.c:1030 [inline]
 __se_sys_exit_group kernel/exit.c:1028 [inline]
 __x64_sys_exit_group+0xe/0x10 kernel/exit.c:1028
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 75 Comm: jfsCommit Tainted: G    B              6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:folio_get include/linux/mm.h:1131 [inline]
RIP: 0010:get_page include/linux/mm.h:1137 [inline]
RIP: 0010:put_metapage+0x23a/0x2a0 fs/jfs/jfs_metapage.c:721
Code: ff 4c 89 f0 48 25 ff 0f 00 00 74 20 e8 1f 7e a2 ff e9 8c fe ff ff e8 15 7e a2 ff 4c 89 f7 48 c7 c6 bc 07 4e 83 e8 b6 cc b4 ff <0f> 0b 4d 8b 26 bb 00 00 01 00 be 00 00 01 00 4c 21 e6 31 ff e8 cd
RSP: 0018:ffffc9000193fdd8 EFLAGS: 00010286
RAX: 8a90bef812367400 RBX: 000000000000007f RCX: ffff8881013ab680
RDX: 0000000000000000 RSI: ffffffff835b033f RDI: ffffffff83548284
RBP: 0000000000000282 R08: ffffffff814c5c83 R09: 0000000000000000
R10: 59535f7972746e65 R11: 535f7972746e6520 R12: 0000000000000012
R13: ffffc900014a5000 R14: ffffea000436a880 R15: ffff8881042ab000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe5bb0e00c0 CR3: 0000000104ff3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 txUnlock+0x30a/0x710 fs/jfs/jfs_txnmgr.c:947
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x22a/0x480 fs/jfs/jfs_txnmgr.c:2732
 kthread+0xf5/0x120 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_get include/linux/mm.h:1131 [inline]
RIP: 0010:get_page include/linux/mm.h:1137 [inline]
RIP: 0010:put_metapage+0x23a/0x2a0 fs/jfs/jfs_metapage.c:721
Code: ff 4c 89 f0 48 25 ff 0f 00 00 74 20 e8 1f 7e a2 ff e9 8c fe ff ff e8 15 7e a2 ff 4c 89 f7 48 c7 c6 bc 07 4e 83 e8 b6 cc b4 ff <0f> 0b 4d 8b 26 bb 00 00 01 00 be 00 00 01 00 4c 21 e6 31 ff e8 cd
RSP: 0018:ffffc9000193fdd8 EFLAGS: 00010286
RAX: 8a90bef812367400 RBX: 000000000000007f RCX: ffff8881013ab680
RDX: 0000000000000000 RSI: ffffffff835b033f RDI: ffffffff83548284
RBP: 0000000000000282 R08: ffffffff814c5c83 R09: 0000000000000000
R10: 59535f7972746e65 R11: 535f7972746e6520 R12: 0000000000000012
R13: ffffc900014a5000 R14: ffffea000436a880 R15: ffff8881042ab000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe5bb0e00c0 CR3: 0000000104ff3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400