program: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r2 = dup(r1) (async) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40081271, &(0x7f0000000980)=0x4000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r2, 0x2c93a000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) close(r4) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, 0x2, 0xfffffffd, 0x0, 0x2}}, 0x2e) (async) ioctl$PPPIOCGMRU(r4, 0x80047453, &(0x7f0000000040)) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newrule={0x24, 0x1a, 0x100, 0x0, 0x0, {0x81, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e24, 0x4e27}}]}, 0x24}}, 0x4008010) [ 103.302716][ T5326] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x2c946 pfn:0x43be7 [ 103.357504][ T5326] memcg:ffff888012051c80 [ 103.360839][ T5326] flags: 0x4fff00000000001(locked|node=1|zone=1|lastcpupid=0x7ff) [ 103.379166][ T5326] raw: 04fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 103.406825][ T5326] raw: 000000000002c946 0000000000000000 00000001ffffffff ffff888012051c80 [ 103.412389][ T5326] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 103.447023][ T5326] page_owner tracks the page as allocated [ 103.451652][ T5326] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5326, tgid 5326 (syz.0.0), ts 103302658173, free_ts 103283448422 [ 103.521442][ T5326] post_alloc_hook+0x1f9/0x250 [ 103.527986][ T5326] get_page_from_freelist+0x21fa/0x2270 [ 103.543905][ T5326] __alloc_frozen_pages_noprof+0x18d/0x380 [ 103.556990][ T5326] alloc_pages_mpol+0x212/0x380 [ 103.560887][ T5326] alloc_pages_noprof+0xac/0x2a0 [ 103.566681][ T5326] folio_alloc_noprof+0x1e/0x30 [ 103.569703][ T5326] filemap_alloc_folio_noprof+0x111/0x470 [ 103.578542][ T5326] page_cache_ra_order+0x569/0xee0 [ 103.587147][ T5326] do_sync_mmap_readahead+0x75e/0x990 [ 103.592947][ T5326] filemap_fault+0x7d9/0x13b0 [ 103.599502][ T5326] __do_fault+0x138/0x2a0 [ 103.608446][ T5326] do_pte_missing+0x684/0x34b0 [ 103.618065][ T5326] handle_mm_fault+0x1b36/0x3080 [ 103.667804][ T5326] do_user_addr_fault+0xa4d/0x1340 [ 103.670757][ T4649] Bluetooth: hci0: command tx timeout [ 103.682643][ T5326] exc_page_fault+0x6a/0xc0 [ 103.747586][ T5326] asm_exc_page_fault+0x26/0x30 [ 103.753193][ T5326] page last free pid 5327 tgid 5326 stack trace: [ 103.760237][ T5326] free_unref_folios+0xd84/0x14a0 [ 103.790102][ T5326] folios_put_refs+0x9e9/0xb30 [ 103.800956][ T5326] truncate_inode_pages_range+0x3ca/0xd80 [ 103.821650][ T5326] set_blocksize+0x2ce/0x440 [ 103.854868][ T5326] blkdev_bszset+0x1b2/0x230 [ 103.856995][ T5326] blkdev_ioctl+0x2c7/0x740 [ 103.858817][ T5326] __se_sys_ioctl+0xfc/0x170 [ 103.863465][ T5326] do_syscall_64+0x174/0x580 [ 103.870080][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.874956][ T5326] ------------[ cut here ]------------ [ 103.884743][ T5326] kernel BUG at mm/filemap.c:859! [ 103.909113][ T5326] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 103.923522][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.927166][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.931643][ T5326] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 103.940474][ T5326] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 9c a3 20 ff 90 0f 0b e8 74 a7 bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 83 a3 20 ff 90 <0f> 0b e8 5b a7 bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 6c a3 20 ff [ 103.962202][ T5326] RSP: 0018:ffffc9000f7475c0 EFLAGS: 00010246 [ 103.970037][ T5326] RAX: b4d6a904b85a2000 RBX: 0000000000000000 RCX: 0000000000000000 [ 103.981080][ T5326] RDX: 0000000000000007 RSI: ffffffff8e231fc8 RDI: 00000000ffffffff [ 103.986746][ T5326] RBP: ffffc9000f747740 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 104.004312][ T5326] R10: dffffc0000000000 R11: fffffbfff20af847 R12: dffffc0000000000 [ 104.009908][ T5326] R13: ffff8880325908c0 R14: 0000000000000002 R15: ffff8880325909d8 [ 104.015834][ T5326] FS: 0000555570183540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 104.026139][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.035072][ T5326] CR2: 00007ff067672730 CR3: 0000000011d77000 CR4: 0000000000352ef0 [ 104.044455][ T5326] Call Trace: [ 104.045858][ T5326] [ 104.047170][ T5326] ? percpu_ref_put+0x19/0x180 [ 104.049195][ T5326] ? __pfx___filemap_add_folio+0x10/0x10 [ 104.051493][ T5326] ? percpu_ref_put+0x19/0x180 [ 104.062710][ T5326] ? percpu_ref_put+0xf9/0x180 [ 104.065674][ T5326] filemap_add_folio+0x25e/0x530 [ 104.075237][ T5326] page_cache_ra_order+0x6d1/0xee0 [ 104.078419][ T5326] do_sync_mmap_readahead+0x75e/0x990 [ 104.081600][ T5326] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 104.095994][ T5326] ? count_memcg_event_mm+0x1d/0x250 [ 104.099592][ T5326] ? count_memcg_event_mm+0x1d/0x250 [ 104.103451][ T5326] filemap_fault+0x7d9/0x13b0 [ 104.114407][ T5326] ? __pfx_filemap_fault+0x10/0x10 [ 104.117661][ T5326] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 104.121087][ T5326] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 104.126636][ T5326] ? lruvec_stat_mod_folio+0x28b/0x3e0 [ 104.133773][ T5326] ? pte_alloc_one+0x1e0/0x370 [ 104.140265][ T5326] __do_fault+0x138/0x2a0 [ 104.149337][ T5326] do_pte_missing+0x684/0x34b0 [ 104.152037][ T5326] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 104.154743][ T5326] ? lock_vma_under_rcu+0x1d1/0x500 [ 104.156866][ T5326] handle_mm_fault+0x1b36/0x3080 [ 104.164953][ T5326] ? handle_mm_fault+0xec/0x3080 [ 104.175257][ T5326] ? __pfx_handle_mm_fault+0x10/0x10 [ 104.177475][ T5326] ? lock_vma_under_rcu+0x45a/0x500 [ 104.179600][ T5326] ? __pfx_do_futex+0x10/0x10 [ 104.181538][ T5326] do_user_addr_fault+0xa4d/0x1340 [ 104.199204][ T5326] ? trace_page_fault_user+0x84/0x1e0 [ 104.202437][ T5326] exc_page_fault+0x6a/0xc0 [ 104.207380][ T5326] asm_exc_page_fault+0x26/0x30 [ 104.212619][ T5326] RIP: 0033:0x7fd54a067587 [ 104.215799][ T5326] Code: 48 85 c0 74 1b 48 83 f8 01 0f 85 bf 03 00 00 0f b7 44 24 10 66 c1 c0 08 0f b7 c0 48 89 44 24 10 48 8b 44 24 18 0f b7 74 24 10 <66> 89 30 e9 18 ff ff ff 48 83 7c 24 08 17 0f 85 20 03 00 00 64 f0 [ 104.237429][ T5326] RSP: 002b:00007ffc4915b8d0 EFLAGS: 00010246 [ 104.243525][ T5326] RAX: 0000200000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 104.252234][ T5326] RDX: dd7684d5e4e508a2 RSI: 0000000000000018 RDI: 0000555570183418 [ 104.260153][ T5326] RBP: 00007ffc4915b9f0 R08: 0000000000000000 R09: 0000000000000000 [ 104.267125][ T5326] R10: 0000000000000018 R11: 0000000000000000 R12: 00007ffc4915ba30 [ 104.274022][ T5326] R13: 00007fd54a42618c R14: 000000000001929c R15: 00007fd54a426180 [ 104.287281][ T5326] [ 104.294456][ T5326] Modules linked in: [ 104.299252][ T5326] ---[ end trace 0000000000000000 ]--- [ 104.485303][ T5326] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 104.497690][ T5326] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 9c a3 20 ff 90 0f 0b e8 74 a7 bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 83 a3 20 ff 90 <0f> 0b e8 5b a7 bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 6c a3 20 ff [ 104.521415][ T5326] RSP: 0018:ffffc9000f7475c0 EFLAGS: 00010246 [ 104.529234][ T5326] RAX: b4d6a904b85a2000 RBX: 0000000000000000 RCX: 0000000000000000 [ 104.544343][ T5326] RDX: 0000000000000007 RSI: ffffffff8e231fc8 RDI: 00000000ffffffff [ 104.549674][ T5326] RBP: ffffc9000f747740 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 104.557270][ T5326] R10: dffffc0000000000 R11: fffffbfff20af847 R12: dffffc0000000000 [ 104.561110][ T5326] R13: ffff8880325908c0 R14: 0000000000000002 R15: ffff8880325909d8 [ 104.575459][ T5326] FS: 0000555570183540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 104.600073][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.615767][ T5326] CR2: 00007fd54a3f36b8 CR3: 0000000011d77000 CR4: 0000000000352ef0 [ 104.620788][ T5326] Kernel panic - not syncing: Fatal exception [ 104.634535][ T5326] Kernel Offset: disabled [ 104.636756][ T5326] Rebooting in 86400 seconds..