program: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xff, 0x1, 0x0, 0x0, 0x0, 0x1, 0x181, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0xfe929fbf8425633a, @perf_bp={0x0, 0x1}, 0x100000, 0x3, 0xb, 0x4, 0x4, 0x1000000, 0xfffb, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x800000000, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000001bc0)=[{&(0x7f00000000c0)="6facaf9ee7a28edaa4523257e1280a255fd9f663a5d602d8ca431334beef8ca46cde7f81b85d68bb0c77be99fb4f9c7e516e6fd4be34c4ee003a260c5660df0c3e", 0x41}], 0x1) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r3, 0x10c, 0x5, &(0x7f00000001c0)=0x7, 0x4) ptrace(0x10, r2) r4 = socket$alg(0x26, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009"], 0x54}}, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r8, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r10 = dup(r9) ioctl$FS_IOC_SETFLAGS(r10, 0x40081271, &(0x7f0000000040)=0x4000) r11 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_DISEQC_SEND_MASTER_CMD(r11, 0x40076f3f, &(0x7f0000000140)={'\x00', 0x6}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r10, 0x2c93a000) madvise(&(0x7f0000201000/0x2000)=nil, 0x2000, 0x9) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004500003000000020fc0290780000001ce00003000306907800fa000945f4fff600652005010400030a010102ac1414aa8cbc6e88eb42557d51c6a87e7874b81bbe2566a8a8"], 0x0) r12 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r12, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) [ 93.959265][ T4652] Bluetooth: hci0: command tx timeout [ 94.208228][ T5331] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.351793][ T5312] IPVS: starting estimator thread 0... [ 94.426293][ T5333] dvmrp0: entered allmulticast mode [ 94.452051][ T5335] IPVS: using max 63 ests per chain, 151200 per kthread [ 94.576495][ T5329] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880125aec00 pfn:0x125ae [ 94.589789][ T5329] memcg:ffff888012e79300 [ 94.594613][ T5329] flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) [ 94.603058][ T5329] raw: 00fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 94.611169][ T5329] raw: ffff8880125aec00 0000000000000000 00000001ffffffff ffff888012e79300 [ 94.621670][ T5329] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 94.633732][ T5329] page_owner tracks the page as allocated [ 94.640542][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5329, tgid 5329 (syz.0.0), ts 94576460948, free_ts 94564233678 [ 94.677703][ T5329] post_alloc_hook+0x1f9/0x250 [ 94.696330][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 94.712044][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.731624][ T5329] alloc_pages_mpol+0x212/0x380 [ 94.734467][ T5329] alloc_pages_noprof+0xac/0x2a0 [ 94.736595][ T5329] folio_alloc_noprof+0x1e/0x30 [ 94.738588][ T5329] filemap_alloc_folio_noprof+0x111/0x470 [ 94.740839][ T5329] page_cache_ra_order+0x569/0xee0 [ 94.744316][ T5329] do_sync_mmap_readahead+0x75e/0x990 [ 94.746717][ T5329] filemap_fault+0x7d9/0x13b0 [ 94.748827][ T5329] __do_fault+0x138/0x2a0 [ 94.750670][ T5329] do_pte_missing+0x684/0x34b0 [ 94.753317][ T5329] handle_mm_fault+0x1b36/0x3080 [ 94.755488][ T5329] do_user_addr_fault+0xa4d/0x1340 [ 94.757722][ T5329] exc_page_fault+0x6a/0xc0 [ 94.759717][ T5329] asm_exc_page_fault+0x26/0x30 [ 94.762364][ T5329] page last free pid 5312 tgid 5312 stack trace: [ 94.765092][ T5329] __free_frozen_pages+0xc1e/0xd10 [ 94.767280][ T5329] __slab_free+0x274/0x2c0 [ 94.769200][ T5329] qlist_free_all+0x99/0x100 [ 94.771143][ T5329] kasan_quarantine_reduce+0x148/0x160 [ 94.774057][ T5329] __kasan_slab_alloc+0x22/0x80 [ 94.776207][ T5329] kmem_cache_alloc_node_noprof+0x355/0x610 [ 94.778713][ T5329] __alloc_skb+0x1d7/0x7a0 [ 94.780753][ T5329] mld_newpack+0x165/0xcb0 [ 94.783291][ T5329] add_grec+0x119f/0x19d0 [ 94.785205][ T5329] mld_send_initial_cr+0x288/0x550 [ 94.787366][ T5329] mld_dad_work+0x3d/0x480 [ 94.789136][ T5329] process_scheduled_works+0xa8e/0x14e0 [ 94.794340][ T5329] worker_thread+0xa47/0xfb0 [ 94.796568][ T5329] kthread+0x388/0x470 [ 94.798675][ T5329] ret_from_fork+0x514/0xb70 [ 94.800879][ T5329] ret_from_fork_asm+0x1a/0x30 [ 94.803930][ T5329] ------------[ cut here ]------------ [ 94.806249][ T5329] kernel BUG at mm/filemap.c:859! [ 94.808497][ T5329] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 94.811935][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.816563][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.821721][ T5329] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 94.824395][ T5329] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 5c 47 21 ff 90 0f 0b e8 64 aa bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 43 47 21 ff 90 <0f> 0b e8 4b aa bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 2c 47 21 ff [ 94.832062][ T5329] RSP: 0018:ffffc9000e5075c0 EFLAGS: 00010246 [ 94.834566][ T5329] RAX: 915b726a07e61700 RBX: 0000000000000000 RCX: 0000000000000000 [ 94.837825][ T5329] RDX: 0000000000000007 RSI: ffffffff8e22ed08 RDI: 00000000ffffffff [ 94.841033][ T5329] RBP: ffffc9000e507740 R08: ffffffff9057b0f7 R09: 1ffffffff20af61e [ 94.844166][ T5329] R10: dffffc0000000000 R11: fffffbfff20af61f R12: dffffc0000000000 [ 94.847457][ T5329] R13: ffff8880325908c0 R14: 0000000000000002 R15: ffff8880325909d8 [ 94.850608][ T5329] FS: 000055556db4f540(0000) GS:ffff88808c546000(0000) knlGS:0000000000000000 [ 94.854126][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.856823][ T5329] CR2: 00007f2bac025fa0 CR3: 00000000122a4000 CR4: 0000000000352ef0 [ 94.860039][ T5329] Call Trace: [ 94.861475][ T5329] [ 94.862675][ T5329] ? percpu_ref_put+0x19/0x180 [ 94.864678][ T5329] ? __pfx___filemap_add_folio+0x10/0x10 [ 94.867058][ T5329] ? percpu_ref_put+0x19/0x180 [ 94.869039][ T5329] ? percpu_ref_put+0xf9/0x180 [ 94.871156][ T5329] filemap_add_folio+0x25e/0x530 [ 94.873173][ T5329] page_cache_ra_order+0x6d1/0xee0 [ 94.875390][ T5329] do_sync_mmap_readahead+0x75e/0x990 [ 94.877700][ T5329] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 94.879985][ T5329] ? count_memcg_event_mm+0x1d/0x250 [ 94.882066][ T5329] ? count_memcg_event_mm+0x1d/0x250 [ 94.884288][ T5329] filemap_fault+0x7d9/0x13b0 [ 94.886271][ T5329] ? futex_unqueue+0x211/0x240 [ 94.888352][ T5329] ? __pfx_filemap_fault+0x10/0x10 [ 94.890469][ T5329] ? __futex_wait+0x36f/0x400 [ 94.892331][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 94.894370][ T5329] ? __pte_offset_map+0x29/0x240 [ 94.896551][ T5329] __do_fault+0x138/0x2a0 [ 94.898482][ T5329] do_pte_missing+0x684/0x34b0 [ 94.900627][ T5329] ? handle_mm_fault+0xec/0x3080 [ 94.902710][ T5329] handle_mm_fault+0x1b36/0x3080 [ 94.904795][ T5329] ? handle_mm_fault+0xec/0x3080 [ 94.906935][ T5329] ? __pfx_handle_mm_fault+0x10/0x10 [ 94.909148][ T5329] ? lock_vma_under_rcu+0x45a/0x500 [ 94.911382][ T5329] ? __pfx_do_futex+0x10/0x10 [ 94.913390][ T5329] do_user_addr_fault+0xa4d/0x1340 [ 94.915554][ T5329] ? trace_page_fault_user+0x84/0x1e0 [ 94.917813][ T5329] exc_page_fault+0x6a/0xc0 [ 94.919759][ T5329] asm_exc_page_fault+0x26/0x30 [ 94.921778][ T5329] RIP: 0033:0x7f2babd6e4b0 [ 94.923676][ T5329] Code: fa 08 73 36 48 83 ea 04 73 e0 83 fa fd 7c 10 8a 0e 74 0a 0f b7 74 16 02 66 89 74 17 02 88 0f c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 fa 7f 07 c5 fa 7f 4c 17 f0 c3 0f 1f 44 00 00 48 8b 4c 16 f8 48 [ 94.931552][ T5329] RSP: 002b:00007ffe166b7258 EFLAGS: 00010206 [ 94.934074][ T5329] RAX: 0000200000000000 RBX: 0000000000000004 RCX: 000000000000003f [ 94.937345][ T5329] RDX: 000000000000001c RSI: 00007f2bab7ff586 RDI: 0000200000000000 [ 94.940656][ T5329] RBP: fffffffffffffffe R08: 00007f2babbff02c R09: 0000000000000001 [ 94.943945][ T5329] R10: 7fffffffffffffe3 R11: 0000000000000009 R12: 00007ffe166b7380 [ 94.947194][ T5329] R13: 00007f2bac02609c R14: 0000000000016e84 R15: 00007ffe166b7360 [ 94.950494][ T5329] [ 94.951832][ T5329] Modules linked in: [ 94.954718][ T5329] ---[ end trace 0000000000000000 ]--- [ 94.962485][ T5329] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 94.965125][ T5329] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 5c 47 21 ff 90 0f 0b e8 64 aa bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 43 47 21 ff 90 <0f> 0b e8 4b aa bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 2c 47 21 ff [ 94.973531][ T5329] RSP: 0018:ffffc9000e5075c0 EFLAGS: 00010246 [ 94.976150][ T5329] RAX: 915b726a07e61700 RBX: 0000000000000000 RCX: 0000000000000000 [ 94.979608][ T5329] RDX: 0000000000000007 RSI: ffffffff8e22ed08 RDI: 00000000ffffffff [ 94.984598][ T5329] RBP: ffffc9000e507740 R08: ffffffff9057b0f7 R09: 1ffffffff20af61e [ 94.988006][ T5329] R10: dffffc0000000000 R11: fffffbfff20af61f R12: dffffc0000000000 [ 94.991223][ T5329] R13: ffff8880325908c0 R14: 0000000000000002 R15: ffff8880325909d8 [ 95.002293][ T5329] FS: 000055556db4f540(0000) GS:ffff88808c546000(0000) knlGS:0000000000000000 [ 95.006212][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.011197][ T5329] CR2: 00007f2bac025fa0 CR3: 00000000122a4000 CR4: 0000000000352ef0 [ 95.014955][ T5329] Kernel panic - not syncing: Fatal exception [ 95.017968][ T5329] Kernel Offset: disabled [ 95.019705][ T5329] Rebooting in 86400 seconds..