[moderation] [mm?] BUG: Bad page map (9)
1 view
Skip to first unread message
syzbot
Dec 20, 2025, 8:29:32 PM (5 hours ago) Dec 20
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 40fbbd64bba6 Merge tag 'pull-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10d91d92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bfa57a8c0ab3aa8
dashboard link: https://syzkaller.appspot.com/bug?extid=32d7126a82fa127794b1
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
CC: [ak...@linux-foundation.org apo...@nvidia.com byun...@sk.com da...@kernel.org gou...@gourry.net joshua...@gmail.com linux-...@vger.kernel.org linu...@kvack.org matthe...@intel.com raki...@sk.com ying....@linux.alibaba.com z...@nvidia.com]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fd8ffc7a6e4/disk-40fbbd64.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4422bf3fbb3e/vmlinux-40fbbd64.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b2d793e3dd2b/bzImage-40fbbd64.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+32d712...@syzkaller.appspotmail.com
BUG: Bad page map in process syz.1.5005 pte:80000000abe00007
pgd:800000006ed2c067 p4d:800000006ed2c067 pud:6ed2b067 pmd:8a983067
page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000001fffffffe 0000000000000000
page dumped because: bad page map
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
addr:00007f0851dfd000 vm_flags:180400fb anon_vma:0000000000000000 mapping:ffff888149090728 index:200
file:kcov fault:0x0 mmap:kcov_mmap mmap_prepare: 0x0 read_folio:0x0
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G U W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
print_bad_page_map mm/memory.c:612 [inline]
print_bad_page_map+0x4b5/0xa00 mm/memory.c:586
zap_present_folio_ptes mm/memory.c:1653 [inline]
zap_present_ptes mm/memory.c:1708 [inline]
do_zap_pte_range mm/memory.c:1810 [inline]
zap_pte_range mm/memory.c:1854 [inline]
zap_pmd_range mm/memory.c:1946 [inline]
zap_pud_range mm/memory.c:1975 [inline]
zap_p4d_range mm/memory.c:1996 [inline]
unmap_page_range+0x1c5d/0x43c0 mm/memory.c:2017
unmap_single_vma+0x153/0x240 mm/memory.c:2059
unmap_vmas+0x218/0x470 mm/memory.c:2101
exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x62/0x70 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x7d7/0x2bd0 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
BUG: Bad page state in process syz.1.5005 pfn:abe00
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: nonzero mapcount
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G BU W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xcf/0x220 mm/page_alloc.c:650
free_page_is_bad mm/page_alloc.c:1083 [inline]
free_page_is_bad mm/page_alloc.c:1077 [inline]
free_pages_prepare mm/page_alloc.c:1387 [inline]
free_unref_folios+0xb43/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0xe9/0x5a0 mm/mmu_gather.c:404
zap_pte_range mm/memory.c:1893 [inline]
zap_pmd_range mm/memory.c:1946 [inline]
zap_pud_range mm/memory.c:1975 [inline]
zap_p4d_range mm/memory.c:1996 [inline]
unmap_page_range+0x1e64/0x43c0 mm/memory.c:2017
unmap_single_vma+0x153/0x240 mm/memory.c:2059
unmap_vmas+0x218/0x470 mm/memory.c:2101
exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x62/0x70 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x7d7/0x2bd0 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1288!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G BU W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS: 0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a8e9d5f820 CR3: 000000003589a000 CR4: 00000000003526f0
Call Trace:
<TASK>
vfree+0x1fd/0xb50 mm/vmalloc.c:3466
kcov_put kernel/kcov.c:439 [inline]
kcov_put kernel/kcov.c:435 [inline]
kcov_close+0x34/0x60 kernel/kcov.c:535
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x87f/0x2bd0 kernel/exit.c:971
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS: 0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fca7f4d5feb CR3: 000000007c89a000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 40fbbd64bba6 Merge tag 'pull-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10d91d92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bfa57a8c0ab3aa8
dashboard link: https://syzkaller.appspot.com/bug?extid=32d7126a82fa127794b1
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
CC: [ak...@linux-foundation.org apo...@nvidia.com byun...@sk.com da...@kernel.org gou...@gourry.net joshua...@gmail.com linux-...@vger.kernel.org linu...@kvack.org matthe...@intel.com raki...@sk.com ying....@linux.alibaba.com z...@nvidia.com]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fd8ffc7a6e4/disk-40fbbd64.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4422bf3fbb3e/vmlinux-40fbbd64.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b2d793e3dd2b/bzImage-40fbbd64.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+32d712...@syzkaller.appspotmail.com
BUG: Bad page map in process syz.1.5005 pte:80000000abe00007
pgd:800000006ed2c067 p4d:800000006ed2c067 pud:6ed2b067 pmd:8a983067
page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000001fffffffe 0000000000000000
page dumped because: bad page map
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
addr:00007f0851dfd000 vm_flags:180400fb anon_vma:0000000000000000 mapping:ffff888149090728 index:200
file:kcov fault:0x0 mmap:kcov_mmap mmap_prepare: 0x0 read_folio:0x0
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G U W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
print_bad_page_map mm/memory.c:612 [inline]
print_bad_page_map+0x4b5/0xa00 mm/memory.c:586
zap_present_folio_ptes mm/memory.c:1653 [inline]
zap_present_ptes mm/memory.c:1708 [inline]
do_zap_pte_range mm/memory.c:1810 [inline]
zap_pte_range mm/memory.c:1854 [inline]
zap_pmd_range mm/memory.c:1946 [inline]
zap_pud_range mm/memory.c:1975 [inline]
zap_p4d_range mm/memory.c:1996 [inline]
unmap_page_range+0x1c5d/0x43c0 mm/memory.c:2017
unmap_single_vma+0x153/0x240 mm/memory.c:2059
unmap_vmas+0x218/0x470 mm/memory.c:2101
exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x62/0x70 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x7d7/0x2bd0 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
BUG: Bad page state in process syz.1.5005 pfn:abe00
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: nonzero mapcount
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G BU W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xcf/0x220 mm/page_alloc.c:650
free_page_is_bad mm/page_alloc.c:1083 [inline]
free_page_is_bad mm/page_alloc.c:1077 [inline]
free_pages_prepare mm/page_alloc.c:1387 [inline]
free_unref_folios+0xb43/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0xe9/0x5a0 mm/mmu_gather.c:404
zap_pte_range mm/memory.c:1893 [inline]
zap_pmd_range mm/memory.c:1946 [inline]
zap_pud_range mm/memory.c:1975 [inline]
zap_p4d_range mm/memory.c:1996 [inline]
unmap_page_range+0x1e64/0x43c0 mm/memory.c:2017
unmap_single_vma+0x153/0x240 mm/memory.c:2059
unmap_vmas+0x218/0x470 mm/memory.c:2101
exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x62/0x70 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x7d7/0x2bd0 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
__vmalloc_area_node mm/vmalloc.c:3863 [inline]
__vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu mm/mmu_gather.c:404 [inline]
tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
vms_clean_up_area mm/vma.c:1250 [inline]
__mmap_setup mm/vma.c:2403 [inline]
__mmap_region+0x627/0x2a00 mm/vma.c:2690
mmap_region+0x1ab/0x3f0 mm/vma.c:2786
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1288!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G BU W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS: 0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a8e9d5f820 CR3: 000000003589a000 CR4: 00000000003526f0
Call Trace:
<TASK>
vfree+0x1fd/0xb50 mm/vmalloc.c:3466
kcov_put kernel/kcov.c:439 [inline]
kcov_put kernel/kcov.c:435 [inline]
kcov_close+0x34/0x60 kernel/kcov.c:535
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x87f/0x2bd0 kernel/exit.c:971
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS: 0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fca7f4d5feb CR3: 000000007c89a000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages