[v6.1] BUG: Bad page map

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8e8fc038cad5 Linux 6.1.168
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11306f16580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=309175ee30e7013e00a2
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/57beeb41ab18/disk-8e8fc038.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d759c245a93a/vmlinux-8e8fc038.xz
kernel image: https://storage.googleapis.com/syzbot-assets/fc000e63f4e4/bzImage-8e8fc038.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+309175...@syzkaller.appspotmail.com

BUG: Bad page map in process syz-executor pte:61006100610061 pmd:7a14b067
addr:00007ff49e7fd000 vm_flags:08100073 anon_vma:ffff88803093e110 mapping:0000000000000000 index:7ff49e7fd
file:(null) fault:0x0 mmap:0x0 read_folio:0x0
CPU: 0 PID: 4255 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_bad_pte+0x54c/0x590 mm/memory.c:566
vm_normal_page+0x131/0x1d0 mm/memory.c:-1
change_pte_range mm/mprotect.c:131 [inline]
change_pmd_range mm/mprotect.c:418 [inline]
change_pud_range mm/mprotect.c:447 [inline]
change_p4d_range mm/mprotect.c:468 [inline]
change_protection_range mm/mprotect.c:492 [inline]
change_protection+0x1175/0x38e0 mm/mprotect.c:514
change_prot_numa+0xff/0x190 mm/mempolicy.c:635
task_numa_work+0x5f5/0x8c0 kernel/sched/fair.c:3022
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff49e557997
Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc38018100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: 0000000000004520 RBX: 0000555570024500 RCX: 00007ff49e557997
RDX: 0000000000004520 RSI: 00007ff496dfbae0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000004520
R13: 0000555570038e60 R14: 00007ffc380186a0 R15: 00007ff496dfbae0
</TASK>
BUG: Bad page map in process syz-executor pte:61006100610061 pmd:7a14b067
addr:00007ff49e7fe000 vm_flags:08100073 anon_vma:ffff88803093e110 mapping:0000000000000000 index:7ff49e7fe
file:(null) fault:0x0 mmap:0x0 read_folio:0x0
CPU: 0 PID: 4255 Comm: syz-executor Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_bad_pte+0x54c/0x590 mm/memory.c:566
vm_normal_page+0x131/0x1d0 mm/memory.c:-1
change_pte_range mm/mprotect.c:131 [inline]
change_pmd_range mm/mprotect.c:418 [inline]
change_pud_range mm/mprotect.c:447 [inline]
change_p4d_range mm/mprotect.c:468 [inline]
change_protection_range mm/mprotect.c:492 [inline]
change_protection+0x1175/0x38e0 mm/mprotect.c:514
change_prot_numa+0xff/0x190 mm/mempolicy.c:635
task_numa_work+0x5f5/0x8c0 kernel/sched/fair.c:3022
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff49e557997
Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc38018100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: 0000000000004520 RBX: 0000555570024500 RCX: 00007ff49e557997
RDX: 0000000000004520 RSI: 00007ff496dfbae0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000004520
R13: 0000555570038e60 R14: 00007ffc380186a0 R15: 00007ff496dfbae0
</TASK>
BUG: Bad page map in process syz-executor pte:61006100610061 pmd:7a14b067
addr:00007ff49e7ff000 vm_flags:08100073 anon_vma:ffff88803093e110 mapping:0000000000000000 index:7ff49e7ff
file:(null) fault:0x0 mmap:0x0 read_folio:0x0
CPU: 0 PID: 4255 Comm: syz-executor Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_bad_pte+0x54c/0x590 mm/memory.c:566
vm_normal_page+0x131/0x1d0 mm/memory.c:-1
change_pte_range mm/mprotect.c:131 [inline]
change_pmd_range mm/mprotect.c:418 [inline]
change_pud_range mm/mprotect.c:447 [inline]
change_p4d_range mm/mprotect.c:468 [inline]
change_protection_range mm/mprotect.c:492 [inline]
change_protection+0x1175/0x38e0 mm/mprotect.c:514
change_prot_numa+0xff/0x190 mm/mempolicy.c:635
task_numa_work+0x5f5/0x8c0 kernel/sched/fair.c:3022
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff49e557997
Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc38018100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: 0000000000004520 RBX: 0000555570024500 RCX: 00007ff49e557997
RDX: 0000000000004520 RSI: 00007ff496dfbae0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000004520
R13: 0000555570038e60 R14: 00007ffc380186a0 R15: 00007ff496dfbae0
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup