Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts.
[+] Starting hugetlb bad page state reproducer...
[+] open /proc/sys/vm/nr_overcommit_hugepages successful.
[+] write to /proc/sys/vm/nr_overcommit_hugepages successful.
[+] close /proc/sys/vm/nr_overcommit_hugepages successful.
[+] open /proc/sys/vm/nr_hugepages successful.
[+] write to /proc/sys/vm/nr_hugepages successful.
[+] close /proc/sys/vm/nr_hugepages successful.
[+] mmap hugetlb at 0x200000000000 successful.
[+] pthread_create faulter 0 successful.
[+] pthread_create faulter 1 successful.
[+] pthread_create faulter 2 successful.
[+] pthread_create faulter 3 successful.
[+] pthread_create zapper 0 successful.
[+] pthread_create zapper 1 successful.
[+] pthread_create zapper 2 successful.
[+] pthread_create zapper 3 successful.
[+] Racing faulter and zapper threads for 25 seconds...
[ 99.740755][ T5970] BUG: Bad page state in process syz-executor125 pfn:60600
[ 99.740795][ T5970] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000a00 pfn:0x60600
[ 99.740821][ T5970] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 99.740834][ T5970] flags: 0xfff00000000058(uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 99.740877][ T5970] raw: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000
[ 99.740898][ T5970] raw: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000
[ 99.740912][ T5970] head: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000
[ 99.740932][ T5970] head: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000
[ 99.740950][ T5970] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 99.740963][ T5970] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 99.740972][ T5970] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 99.740990][ T5970] page_owner tracks the page as allocated
[ 99.740997][ T5970] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5964, tgid 5962 (syz-executor125), ts 99736440450
[ 99.741023][ T5970] post_alloc_hook+0x1f9/0x250
[ 99.741051][ T5970] get_page_from_freelist+0x220f/0x2280
[ 99.741072][ T5970] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 99.741093][ T5970] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 99.741122][ T5970] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 99.741146][ T5970] hugetlb_alloc_folio+0x568/0xb00
[ 99.741166][ T5970] alloc_hugetlb_folio+0x57c/0x900
[ 99.741185][ T5970] hugetlb_no_page+0xea5/0x16f0
[ 99.741208][ T5970] hugetlb_fault+0x776/0x1440
[ 99.741230][ T5970] handle_mm_fault+0x24fc/0x3750
[ 99.741253][ T5970] do_user_addr_fault+0xb35/0x1480
[ 99.741271][ T5970] exc_page_fault+0x6a/0xc0
[ 99.741302][ T5970] asm_exc_page_fault+0x26/0x30
[ 99.741316][ T5970] page last free pid 5968 tgid 5962 ts 99714065632 stack trace:
[ 99.741326][ T5970] __free_frozen_pages+0xc97/0xd90
[ 99.741340][ T5970] update_and_free_hugetlb_folio+0x17c/0x280
[ 99.741356][ T5970] folios_put_refs+0x73d/0xb30
[ 99.741377][ T5970] free_pages_and_swap_cache+0x41e/0x490
[ 99.741402][ T5970] tlb_flush_mmu+0x6d3/0xa30
[ 99.742906][ T5970] tlb_finish_mmu+0xf4/0x220
[ 99.742925][ T5970] zap_vma_range_batched+0x4b0/0x5a0
[ 99.742943][ T5970] madvise_vma_behavior+0x2361/0x43b0
[ 99.742962][ T5970] madvise_walk_vmas+0x924/0xb00
[ 99.742980][ T5970] madvise_do_behavior+0x385/0x540
[ 99.743000][ T5970] do_madvise+0x327/0x3a0
[ 99.743017][ T5970] __x64_sys_madvise+0xa6/0xc0
[ 99.743035][ T5970] do_syscall_64+0x166/0x520
[ 99.743052][ T5970] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 99.743070][ T5970] Modules linked in:
[ 99.743104][ T5970] CPU: 1 UID: 0 PID: 5970 Comm: syz-executor125 Not tainted syzkaller #0 PREEMPT(full)
[ 99.743127][ T5970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 99.743143][ T5970] Call Trace:
[ 99.743151][ T5970]
[ 99.743160][ T5970] dump_stack_lvl+0xe8/0x150
[ 99.743188][ T5970] bad_page+0xdc/0x120
[ 99.743213][ T5970] __free_frozen_pages+0xd3b/0xd90
[ 99.743240][ T5970] update_and_free_hugetlb_folio+0x17c/0x280
[ 99.743264][ T5970] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 99.743283][ T5970] ? free_huge_folio+0xc6b/0xf20
[ 99.743315][ T5970] folios_put_refs+0x73d/0xb30
[ 99.743351][ T5970] ? __pfx_folios_put_refs+0x10/0x10
[ 99.743373][ T5970] ? smp_call_function_many_cond+0x11b2/0x1500
[ 99.743402][ T5970] ? free_swap_cache+0x9b/0x300
[ 99.743435][ T5970] free_pages_and_swap_cache+0x41e/0x490
[ 99.743468][ T5970] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 99.743493][ T5970] ? rcu_is_watching+0x16/0xb0
[ 99.743540][ T5970] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 99.743581][ T5970] tlb_flush_mmu+0x6d3/0xa30
[ 99.743607][ T5970] tlb_finish_mmu+0xf4/0x220
[ 99.743632][ T5970] zap_vma_range_batched+0x4b0/0x5a0
[ 99.743651][ T5970] ? ktime_get+0x45/0x220
[ 99.743679][ T5970] ? __pfx_zap_vma_range_batched+0x10/0x10
[ 99.743698][ T5970] ? clockevents_program_event+0x491/0x630
[ 99.743724][ T5970] ? madvise_vma_behavior+0x22d5/0x43b0
[ 99.743750][ T5970] madvise_vma_behavior+0x2361/0x43b0
[ 99.743781][ T5970] ? __pfx_madvise_vma_behavior+0x10/0x10
[ 99.743802][ T5970] ? trace_sched_exit_tp+0x3a/0x130
[ 99.743827][ T5970] ? __schedule+0x17f3/0x5820
[ 99.743852][ T5970] ? finish_task_switch+0x40e/0xc60
[ 99.743892][ T5970] ? __lock_acquire+0x747/0x2de0
[ 99.743925][ T5970] ? irqentry_exit+0x2a0/0x9b0
[ 99.743965][ T5970] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 99.743985][ T5970] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 99.744001][ T5970] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90
[ 99.744036][ T5970] ? __rcu_read_unlock+0x83/0xe0
[ 99.744056][ T5970] ? lock_vma_under_rcu+0x116/0x500
[ 99.744081][ T5970] ? lock_vma_under_rcu+0x45a/0x500
[ 99.744108][ T5970] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 99.744140][ T5970] ? trace_tlb_flush+0x3c/0x160
[ 99.744165][ T5970] madvise_walk_vmas+0x924/0xb00
[ 99.744195][ T5970] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 99.744213][ T5970] ? __pfx_madvise_walk_vmas+0x10/0x10
[ 99.744239][ T5970] ? blk_start_plug+0x6e/0x1b0
[ 99.744262][ T5970] madvise_do_behavior+0x385/0x540
[ 99.744289][ T5970] ? __pfx_madvise_do_behavior+0x10/0x10
[ 99.744322][ T5970] ? tlb_gather_mmu+0x22e/0x2f0
[ 99.744343][ T5970] do_madvise+0x327/0x3a0
[ 99.744366][ T5970] ? __pfx_do_madvise+0x10/0x10
[ 99.744397][ T5970] ? lockdep_hardirqs_on+0x7b/0x110
[ 99.744430][ T5970] ? rcu_is_watching+0x16/0xb0
[ 99.744460][ T5970] __x64_sys_madvise+0xa6/0xc0
[ 99.744482][ T5970] do_syscall_64+0x166/0x520
[ 99.744502][ T5970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 99.744519][ T5970] ? clear_bhb_loop+0x70/0xc0
[ 99.744540][ T5970] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 99.744557][ T5970] RIP: 0033:0x7f6a83c0bd37
[ 99.744582][ T5970] Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[ 99.744596][ T5970] RSP: 002b:00007f6a803d0178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
[ 99.744614][ T5970] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
[ 99.744627][ T5970] RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
[ 99.744638][ T5970] RBP: 0000000000000003 R08: 1999999999999999 R09: 0000000000000000
[ 99.744649][ T5970] R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
[ 99.744661][ T5970] R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
[ 99.744689][ T5970]
[ 99.792929][ T5970] Disabling lock debugging due to kernel taint
[ 103.050134][ T5967] BUG: Bad page state in process syz-executor125 pfn:70e00
[ 103.050152][ T5967] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000400 pfn:0x70e00
[ 103.050164][ T5967] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 103.050171][ T5967] flags: 0xfff00000000059(locked|uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 103.050187][ T5967] raw: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 103.050195][ T5967] raw: 0000000200000400 0000000000000000 00000000ffffffff 0000000000000000
[ 103.050203][ T5967] head: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 103.050211][ T5967] head: 0000000200000400 0000000000000000 00000000ffffffff 0000000000000000
[ 103.050219][ T5967] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 103.050227][ T5967] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 103.050232][ T5967] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 103.050237][ T5967] page_owner tracks the page as allocated
[ 103.050240][ T5967] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5963, tgid 5962 (syz-executor125), ts 103049540885
[ 103.050256][ T5967] post_alloc_hook+0x1f9/0x250
[ 103.050269][ T5967] get_page_from_freelist+0x220f/0x2280
[ 103.050280][ T5967] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 103.050290][ T5967] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 103.050305][ T5967] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 103.050318][ T5967] hugetlb_alloc_folio+0x568/0xb00
[ 103.050328][ T5967] alloc_hugetlb_folio+0x57c/0x900
[ 103.050338][ T5967] hugetlb_no_page+0xea5/0x16f0
[ 103.050349][ T5967] hugetlb_fault+0x776/0x1440
[ 103.050360][ T5967] handle_mm_fault+0x24fc/0x3750
[ 103.050373][ T5967] do_user_addr_fault+0xb35/0x1480
[ 103.050383][ T5967] exc_page_fault+0x6a/0xc0
[ 103.050393][ T5967] asm_exc_page_fault+0x26/0x30
[ 103.050401][ T5967] page last free pid 5967 tgid 5962 ts 103047661002 stack trace:
[ 103.050408][ T5967] __free_frozen_pages+0xc97/0xd90
[ 103.050416][ T5967] update_and_free_hugetlb_folio+0x17c/0x280
[ 103.050426][ T5967] folios_put_refs+0x73d/0xb30
[ 103.050439][ T5967] free_pages_and_swap_cache+0x41e/0x490
[ 103.050453][ T5967] tlb_flush_mmu+0x6d3/0xa30
[ 103.050463][ T5967] tlb_finish_mmu+0xf4/0x220
[ 103.050472][ T5967] zap_vma_range_batched+0x4b0/0x5a0
[ 103.050482][ T5967] madvise_vma_behavior+0x2361/0x43b0
[ 103.050492][ T5967] madvise_walk_vmas+0x924/0xb00
[ 103.050502][ T5967] madvise_do_behavior+0x385/0x540
[ 103.050512][ T5967] do_madvise+0x327/0x3a0
[ 103.050521][ T5967] __x64_sys_madvise+0xa6/0xc0
[ 103.050531][ T5967] do_syscall_64+0x166/0x520
[ 103.050541][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.050550][ T5967] Modules linked in:
[ 103.050562][ T5967] CPU: 0 UID: 0 PID: 5967 Comm: syz-executor125 Tainted: G B syzkaller #0 PREEMPT(full)
[ 103.050576][ T5967] Tainted: [B]=BAD_PAGE
[ 103.050579][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 103.050586][ T5967] Call Trace:
[ 103.050591][ T5967]
[ 103.050595][ T5967] dump_stack_lvl+0xe8/0x150
[ 103.050611][ T5967] bad_page+0xdc/0x120
[ 103.050628][ T5967] __free_frozen_pages+0xd3b/0xd90
[ 103.050639][ T5967] update_and_free_hugetlb_folio+0x17c/0x280
[ 103.050651][ T5967] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 103.050661][ T5967] ? free_huge_folio+0xc6b/0xf20
[ 103.050671][ T5967] ? irqentry_exit+0x2a0/0x9b0
[ 103.050683][ T5967] folios_put_refs+0x73d/0xb30
[ 103.050698][ T5967] ? __pfx_folios_put_refs+0x10/0x10
[ 103.050711][ T5967] ? smp_call_function_many_cond+0x11b2/0x1500
[ 103.050726][ T5967] ? free_swap_cache+0x9b/0x300
[ 103.050739][ T5967] free_pages_and_swap_cache+0x41e/0x490
[ 103.050755][ T5967] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 103.050769][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.050788][ T5967] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 103.050797][ T5967] ? try_to_wake_up+0x8ce/0x14e0
[ 103.050813][ T5967] ? rwsem_wake+0xe8/0x130
[ 103.050823][ T5967] tlb_flush_mmu+0x6d3/0xa30
[ 103.050834][ T5967] tlb_finish_mmu+0xf4/0x220
[ 103.050844][ T5967] zap_vma_range_batched+0x4b0/0x5a0
[ 103.050855][ T5967] ? trace_irq_enable+0x3b/0x140
[ 103.050869][ T5967] ? __pfx_zap_vma_range_batched+0x10/0x10
[ 103.050882][ T5967] ? madvise_vma_behavior+0x22d5/0x43b0
[ 103.050894][ T5967] madvise_vma_behavior+0x2361/0x43b0
[ 103.050905][ T5967] ? trace_pelt_se_tp+0x3b/0x150
[ 103.050920][ T5967] ? __pfx_madvise_vma_behavior+0x10/0x10
[ 103.050931][ T5967] ? kvm_sched_clock_read+0x11/0x20
[ 103.050940][ T5967] ? sched_clock+0x41/0x60
[ 103.050954][ T5967] ? sched_clock_cpu+0x74/0x440
[ 103.050965][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.050979][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.050992][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051005][ T5967] ? trace_irq_enable+0x3b/0x140
[ 103.051018][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051030][ T5967] ? trace_sched_exit_tp+0x3a/0x130
[ 103.051043][ T5967] ? __schedule+0x17f3/0x5820
[ 103.051053][ T5967] ? clockevents_program_event+0x491/0x630
[ 103.051063][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051076][ T5967] ? trace_irq_enable+0x3b/0x140
[ 103.051089][ T5967] ? irqentry_exit+0x2a0/0x9b0
[ 103.051098][ T5967] ? trace_irq_disable+0x3b/0x140
[ 103.051111][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051129][ T5967] ? lock_acquire+0x58/0x350
[ 103.051141][ T5967] ? irqentry_exit+0x2a0/0x9b0
[ 103.051150][ T5967] ? trace_irq_disable+0x3b/0x140
[ 103.051163][ T5967] ? vma_start_read+0x2f8/0x5b0
[ 103.051176][ T5967] ? vma_start_read+0x368/0x5b0
[ 103.051190][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051203][ T5967] ? lock_release+0x4b/0x3c0
[ 103.051214][ T5967] ? lock_vma_under_rcu+0x116/0x500
[ 103.051227][ T5967] ? lock_vma_under_rcu+0x45a/0x500
[ 103.051240][ T5967] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 103.051255][ T5967] ? trace_tlb_flush+0x3c/0x160
[ 103.051266][ T5967] madvise_walk_vmas+0x924/0xb00
[ 103.051279][ T5967] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 103.051290][ T5967] ? __pfx_madvise_walk_vmas+0x10/0x10
[ 103.051302][ T5967] ? blk_start_plug+0x6e/0x1b0
[ 103.051313][ T5967] madvise_do_behavior+0x385/0x540
[ 103.051326][ T5967] ? __pfx_madvise_do_behavior+0x10/0x10
[ 103.051339][ T5967] ? tlb_gather_mmu+0x22e/0x2f0
[ 103.051349][ T5967] do_madvise+0x327/0x3a0
[ 103.051360][ T5967] ? __pfx_do_madvise+0x10/0x10
[ 103.051370][ T5967] ? ktime_get_update_offsets_now+0x3bb/0x3f0
[ 103.051390][ T5967] ? rcu_is_watching+0x16/0xb0
[ 103.051404][ T5967] __x64_sys_madvise+0xa6/0xc0
[ 103.051415][ T5967] do_syscall_64+0x166/0x520
[ 103.051425][ T5967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.051435][ T5967] ? clear_bhb_loop+0x70/0xc0
[ 103.051445][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.051455][ T5967] RIP: 0033:0x7f6a83c0bd37
[ 103.051464][ T5967] Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[ 103.051472][ T5967] RSP: 002b:00007f6a81bd3178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
[ 103.051483][ T5967] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
[ 103.051490][ T5967] RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
[ 103.051496][ T5967] RBP: 0000000000000000 R08: 1999999999999999 R09: 0000000000000000
[ 103.051502][ T5967] R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
[ 103.051508][ T5967] R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
[ 103.051518][ T5967]
[ 105.847370][ T5969] BUG: Bad page state in process syz-executor125 pfn:5e600
[ 105.847394][ T5969] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000200 pfn:0x5e600
[ 105.847410][ T5969] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 105.847424][ T5969] flags: 0xfff00000000059(locked|uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 105.847449][ T5969] raw: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 105.847464][ T5969] raw: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 105.847480][ T5969] head: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 105.847494][ T5969] head: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 105.847509][ T5969] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 105.847614][ T5969] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 105.847623][ T5969] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 105.847632][ T5969] page_owner tracks the page as allocated
[ 105.847638][ T5969] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5965, tgid 5962 (syz-executor125), ts 105846881904
[ 105.847665][ T5969] post_alloc_hook+0x1f9/0x250
[ 105.847685][ T5969] get_page_from_freelist+0x220f/0x2280
[ 105.847704][ T5969] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 105.847723][ T5969] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 105.847746][ T5969] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 105.847769][ T5969] hugetlb_alloc_folio+0x568/0xb00
[ 105.847788][ T5969] alloc_hugetlb_folio+0x57c/0x900
[ 105.847806][ T5969] hugetlb_no_page+0xea5/0x16f0
[ 105.847827][ T5969] hugetlb_fault+0x776/0x1440
[ 105.847848][ T5969] handle_mm_fault+0x24fc/0x3750
[ 105.847869][ T5969] do_user_addr_fault+0xb35/0x1480
[ 105.847888][ T5969] exc_page_fault+0x6a/0xc0
[ 105.847955][ T5969] asm_exc_page_fault+0x26/0x30
[ 105.847971][ T5969] page last free pid 5969 tgid 5962 ts 105844746751 stack trace:
[ 105.847983][ T5969] __free_frozen_pages+0xc97/0xd90
[ 105.847998][ T5969] update_and_free_hugetlb_folio+0x17c/0x280
[ 105.848016][ T5969] folios_put_refs+0x73d/0xb30
[ 105.848039][ T5969] free_pages_and_swap_cache+0x41e/0x490
[ 105.848064][ T5969] tlb_flush_mmu+0x6d3/0xa30
[ 105.848080][ T5969] tlb_finish_mmu+0xf4/0x220
[ 105.848096][ T5969] zap_vma_range_batched+0x4b0/0x5a0
[ 105.848115][ T5969] madvise_vma_behavior+0x2361/0x43b0
[ 105.848134][ T5969] madvise_walk_vmas+0x924/0xb00
[ 105.848152][ T5969] madvise_do_behavior+0x385/0x540
[ 105.848171][ T5969] do_madvise+0x327/0x3a0
[ 105.848188][ T5969] __x64_sys_madvise+0xa6/0xc0
[ 105.848206][ T5969] do_syscall_64+0x166/0x520
[ 105.848224][ T5969] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.848241][ T5969] Modules linked in:
[ 105.848259][ T5969] CPU: 0 UID: 0 PID: 5969 Comm: syz-executor125 Tainted: G B syzkaller #0 PREEMPT(full)
[ 105.848283][ T5969] Tainted: [B]=BAD_PAGE
[ 105.848289][ T5969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 105.848298][ T5969] Call Trace:
[ 105.848306][ T5969]
[ 105.848313][ T5969] dump_stack_lvl+0xe8/0x150
[ 105.848339][ T5969] bad_page+0xdc/0x120
[ 105.848363][ T5969] __free_frozen_pages+0xd3b/0xd90
[ 105.848383][ T5969] update_and_free_hugetlb_folio+0x17c/0x280
[ 105.848404][ T5969] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 105.848424][ T5969] ? free_huge_folio+0xc6b/0xf20
[ 105.848445][ T5969] folios_put_refs+0x73d/0xb30
[ 105.848472][ T5969] ? __pfx_flush_tlb_func+0x10/0x10
[ 105.848490][ T5969] ? __pfx_folios_put_refs+0x10/0x10
[ 105.848513][ T5969] ? smp_call_function_many_cond+0x11b2/0x1500
[ 105.848539][ T5969] ? free_swap_cache+0x9b/0x300
[ 105.848564][ T5969] free_pages_and_swap_cache+0x41e/0x490
[ 105.848596][ T5969] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 105.848621][ T5969] ? rcu_is_watching+0x16/0xb0
[ 105.848655][ T5969] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 105.848672][ T5969] ? try_to_wake_up+0x8ce/0x14e0
[ 105.848699][ T5969] ? rwsem_wake+0xe8/0x130
[ 105.848716][ T5969] tlb_flush_mmu+0x6d3/0xa30
[ 105.848736][ T5969] tlb_finish_mmu+0xf4/0x220
[ 105.848756][ T5969] zap_vma_range_batched+0x4b0/0x5a0
[ 105.848779][ T5969] ? __pfx_zap_vma_range_batched+0x10/0x10
[ 105.848802][ T5969] ? madvise_vma_behavior+0x22d5/0x43b0
[ 105.848825][ T5969] madvise_vma_behavior+0x2361/0x43b0
[ 105.848850][ T5969] ? __pfx_madvise_vma_behavior+0x10/0x10
[ 105.848872][ T5969] ? trace_sched_exit_tp+0x3a/0x130
[ 105.848895][ T5969] ? __schedule+0x17f3/0x5820
[ 105.848926][ T5969] ? trace_sched_exit_tp+0x3a/0x130
[ 105.848949][ T5969] ? __pfx___schedule+0x10/0x10
[ 105.848964][ T5969] ? __schedule+0x17f3/0x5820
[ 105.848981][ T5969] ? clockevents_program_event+0x491/0x630
[ 105.849001][ T5969] ? rcu_is_watching+0x16/0xb0
[ 105.849024][ T5969] ? trace_irq_enable+0x3b/0x140
[ 105.849048][ T5969] ? irqentry_exit+0x2a0/0x9b0
[ 105.849065][ T5969] ? trace_irq_disable+0x3b/0x140
[ 105.849090][ T5969] ? rcu_is_watching+0x16/0xb0
[ 105.849114][ T5969] ? rcu_is_watching+0x16/0xb0
[ 105.849138][ T5969] ? trace_irq_enable+0x3b/0x140
[ 105.849161][ T5969] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 105.849178][ T5969] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90
[ 105.849205][ T5969] ? __rcu_read_unlock+0x83/0xe0
[ 105.849224][ T5969] ? lock_vma_under_rcu+0x116/0x500
[ 105.849248][ T5969] ? lock_vma_under_rcu+0x45a/0x500
[ 105.849273][ T5969] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 105.849302][ T5969] ? ktime_get+0x45/0x220
[ 105.849322][ T5969] ? seqcount_lockdep_reader_access+0xd4/0x100
[ 105.849346][ T5969] madvise_walk_vmas+0x924/0xb00
[ 105.849369][ T5969] ? __pfx_clockevents_program_event+0x10/0x10
[ 105.849388][ T5969] ? __pfx_madvise_walk_vmas+0x10/0x10
[ 105.849409][ T5969] ? blk_start_plug+0x6e/0x1b0
[ 105.849429][ T5969] madvise_do_behavior+0x385/0x540
[ 105.849449][ T5969] ? trace_irq_disable+0x3b/0x140
[ 105.849473][ T5969] ? __pfx_madvise_do_behavior+0x10/0x10
[ 105.849496][ T5969] ? madvise_behavior_valid+0x16/0x200
[ 105.849518][ T5969] ? tlb_gather_mmu+0x22e/0x2f0
[ 105.849537][ T5969] do_madvise+0x327/0x3a0
[ 105.849557][ T5969] ? __pfx_do_madvise+0x10/0x10
[ 105.849575][ T5969] ? ktime_get_update_offsets_now+0x3bb/0x3f0
[ 105.849609][ T5969] ? rcu_is_watching+0x16/0xb0
[ 105.849637][ T5969] __x64_sys_madvise+0xa6/0xc0
[ 105.849657][ T5969] do_syscall_64+0x166/0x520
[ 105.849676][ T5969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.849692][ T5969] ? clear_bhb_loop+0x70/0xc0
[ 105.849711][ T5969] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.849728][ T5969] RIP: 0033:0x7f6a83c0bd37
[ 105.849744][ T5969] Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[ 105.849758][ T5969] RSP: 002b:00007f6a80bd1178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
[ 105.849775][ T5969] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
[ 105.849788][ T5969] RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
[ 105.849799][ T5969] RBP: 0000000000000002 R08: 1999999999999999 R09: 0000000000000000
[ 105.849810][ T5969] R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
[ 105.849823][ T5969] R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
[ 105.849837][ T5969]
[ 106.683373][ T5968] BUG: Bad page state in process syz-executor125 pfn:6aa00
[ 106.683398][ T5968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000200 pfn:0x6aa00
[ 106.683415][ T5968] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 106.683429][ T5968] flags: 0xfff00000000059(locked|uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 106.683468][ T5968] raw: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 106.683483][ T5968] raw: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 106.683500][ T5968] head: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 106.683515][ T5968] head: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 106.683531][ T5968] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 106.683545][ T5968] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 106.683552][ T5968] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 106.683560][ T5968] page_owner tracks the page as allocated
[ 106.683565][ T5968] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5965, tgid 5962 (syz-executor125), ts 106681187495
[ 106.683588][ T5968] post_alloc_hook+0x1f9/0x250
[ 106.683607][ T5968] get_page_from_freelist+0x220f/0x2280
[ 106.683623][ T5968] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 106.683638][ T5968] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 106.683661][ T5968] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 106.683682][ T5968] hugetlb_alloc_folio+0x568/0xb00
[ 106.683698][ T5968] alloc_hugetlb_folio+0x57c/0x900
[ 106.683715][ T5968] hugetlb_no_page+0xea5/0x16f0
[ 106.683733][ T5968] hugetlb_fault+0x776/0x1440
[ 106.683754][ T5968] handle_mm_fault+0x24fc/0x3750
[ 106.683777][ T5968] do_user_addr_fault+0xb35/0x1480
[ 106.683796][ T5968] exc_page_fault+0x6a/0xc0
[ 106.683827][ T5968] asm_exc_page_fault+0x26/0x30
[ 106.683844][ T5968] page last free pid 5967 tgid 5962 ts 106677978994 stack trace:
[ 106.683856][ T5968] __free_frozen_pages+0xc97/0xd90
[ 106.683871][ T5968] update_and_free_hugetlb_folio+0x17c/0x280
[ 106.683890][ T5968] folios_put_refs+0x73d/0xb30
[ 106.683913][ T5968] free_pages_and_swap_cache+0x41e/0x490
[ 106.683939][ T5968] tlb_flush_mmu+0x6d3/0xa30
[ 106.683956][ T5968] tlb_finish_mmu+0xf4/0x220
[ 106.683972][ T5968] zap_vma_range_batched+0x4b0/0x5a0
[ 106.683990][ T5968] madvise_vma_behavior+0x2361/0x43b0
[ 106.684011][ T5968] madvise_walk_vmas+0x924/0xb00
[ 106.684030][ T5968] madvise_do_behavior+0x385/0x540
[ 106.684049][ T5968] do_madvise+0x327/0x3a0
[ 106.684066][ T5968] __x64_sys_madvise+0xa6/0xc0
[ 106.684084][ T5968] do_syscall_64+0x166/0x520
[ 106.684102][ T5968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.684119][ T5968] Modules linked in:
[ 106.684137][ T5968] CPU: 1 UID: 0 PID: 5968 Comm: syz-executor125 Tainted: G B syzkaller #0 PREEMPT(full)
[ 106.684161][ T5968] Tainted: [B]=BAD_PAGE
[ 106.684167][ T5968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 106.684178][ T5968] Call Trace:
[ 106.684185][ T5968]
[ 106.684192][ T5968] dump_stack_lvl+0xe8/0x150
[ 106.684219][ T5968] bad_page+0xdc/0x120
[ 106.684243][ T5968] __free_frozen_pages+0xd3b/0xd90
[ 106.684264][ T5968] update_and_free_hugetlb_folio+0x17c/0x280
[ 106.684286][ T5968] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 106.684306][ T5968] ? free_huge_folio+0xc6b/0xf20
[ 106.684329][ T5968] folios_put_refs+0x73d/0xb30
[ 106.684356][ T5968] ? __pfx_flush_tlb_func+0x10/0x10
[ 106.684374][ T5968] ? __pfx_folios_put_refs+0x10/0x10
[ 106.684397][ T5968] ? smp_call_function_many_cond+0x11b2/0x1500
[ 106.684423][ T5968] ? free_swap_cache+0x9b/0x300
[ 106.684455][ T5968] free_pages_and_swap_cache+0x41e/0x490
[ 106.684485][ T5968] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 106.684509][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.684540][ T5968] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 106.684554][ T5968] ? try_to_wake_up+0x8ce/0x14e0
[ 106.684578][ T5968] ? rwsem_wake+0xe8/0x130
[ 106.684595][ T5968] tlb_flush_mmu+0x6d3/0xa30
[ 106.684614][ T5968] tlb_finish_mmu+0xf4/0x220
[ 106.684633][ T5968] zap_vma_range_batched+0x4b0/0x5a0
[ 106.684652][ T5968] ? trace_irq_enable+0x3b/0x140
[ 106.684675][ T5968] ? __pfx_zap_vma_range_batched+0x10/0x10
[ 106.684696][ T5968] ? madvise_vma_behavior+0x22d5/0x43b0
[ 106.684722][ T5968] madvise_vma_behavior+0x2361/0x43b0
[ 106.684745][ T5968] ? __pfx_madvise_vma_behavior+0x10/0x10
[ 106.684766][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.684789][ T5968] ? trace_irq_enable+0x3b/0x140
[ 106.684810][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.684833][ T5968] ? trace_sched_exit_tp+0x3a/0x130
[ 106.684855][ T5968] ? __schedule+0x17f3/0x5820
[ 106.684874][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.684897][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.684918][ T5968] ? lock_release+0x4b/0x3c0
[ 106.684938][ T5968] ? trace_irq_enable+0x3b/0x140
[ 106.684959][ T5968] ? ktime_get+0x45/0x220
[ 106.684979][ T5968] ? seqcount_lockdep_reader_access+0xd4/0x100
[ 106.685002][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.685027][ T5968] ? trace_irq_enable+0x3b/0x140
[ 106.685050][ T5968] ? irqentry_exit+0x2a0/0x9b0
[ 106.685069][ T5968] ? trace_irq_disable+0x3b/0x140
[ 106.685094][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.685114][ T5968] ? lock_acquire+0x58/0x350
[ 106.685130][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.685149][ T5968] ? trace_irq_enable+0x3b/0x140
[ 106.685169][ T5968] ? vma_start_read+0x2f8/0x5b0
[ 106.685189][ T5968] ? vma_start_read+0x368/0x5b0
[ 106.685217][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.685236][ T5968] ? lock_release+0x4b/0x3c0
[ 106.685255][ T5968] ? lock_vma_under_rcu+0x116/0x500
[ 106.685280][ T5968] ? lock_vma_under_rcu+0x45a/0x500
[ 106.685301][ T5968] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 106.685325][ T5968] ? trace_tlb_flush+0x3c/0x160
[ 106.685345][ T5968] madvise_walk_vmas+0x924/0xb00
[ 106.685368][ T5968] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 106.685385][ T5968] ? __pfx_madvise_walk_vmas+0x10/0x10
[ 106.685406][ T5968] ? blk_start_plug+0x6e/0x1b0
[ 106.685425][ T5968] madvise_do_behavior+0x385/0x540
[ 106.685459][ T5968] ? __pfx_madvise_do_behavior+0x10/0x10
[ 106.685483][ T5968] ? tlb_gather_mmu+0x22e/0x2f0
[ 106.685582][ T5968] do_madvise+0x327/0x3a0
[ 106.685612][ T5968] ? __pfx_do_madvise+0x10/0x10
[ 106.685631][ T5968] ? ktime_get_update_offsets_now+0x3bb/0x3f0
[ 106.685663][ T5968] ? sched_clock+0x41/0x60
[ 106.685688][ T5968] ? sched_clock_cpu+0x74/0x440
[ 106.685713][ T5968] ? rcu_is_watching+0x16/0xb0
[ 106.685741][ T5968] __x64_sys_madvise+0xa6/0xc0
[ 106.685763][ T5968] do_syscall_64+0x166/0x520
[ 106.685784][ T5968] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.685803][ T5968] ? clear_bhb_loop+0x70/0xc0
[ 106.685840][ T5968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.685863][ T5968] RIP: 0033:0x7f6a83c0bd37
[ 106.685882][ T5968] Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[ 106.685909][ T5968] RSP: 002b:00007f6a813d2178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
[ 106.685929][ T5968] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
[ 106.685942][ T5968] RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
[ 106.685952][ T5968] RBP: 0000000000000001 R08: 1999999999999999 R09: 0000000000000000
[ 106.685962][ T5968] R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
[ 106.685973][ T5968] R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
[ 106.685989][ T5968]
[ 107.561957][ T5969] BUG: Bad page state in process syz-executor125 pfn:62200
[ 107.561980][ T5969] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000600 pfn:0x62200
[ 107.561997][ T5969] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 107.562011][ T5969] flags: 0xfff00000000059(locked|uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 107.562036][ T5969] raw: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 107.562051][ T5969] raw: 0000000200000600 0000000000000000 00000000ffffffff 0000000000000000
[ 107.562067][ T5969] head: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 107.562082][ T5969] head: 0000000200000600 0000000000000000 00000000ffffffff 0000000000000000
[ 107.562096][ T5969] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 107.562111][ T5969] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 107.562120][ T5969] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 107.562128][ T5969] page_owner tracks the page as allocated
[ 107.562134][ T5969] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5964, tgid 5962 (syz-executor125), ts 107560358078
[ 107.562161][ T5969] post_alloc_hook+0x1f9/0x250
[ 107.562180][ T5969] get_page_from_freelist+0x220f/0x2280
[ 107.562198][ T5969] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 107.562216][ T5969] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 107.562241][ T5969] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 107.562264][ T5969] hugetlb_alloc_folio+0x568/0xb00
[ 107.562282][ T5969] alloc_hugetlb_folio+0x57c/0x900
[ 107.562300][ T5969] hugetlb_no_page+0xea5/0x16f0
[ 107.562320][ T5969] hugetlb_fault+0x776/0x1440
[ 107.562353][ T5969] handle_mm_fault+0x24fc/0x3750
[ 107.562375][ T5969] do_user_addr_fault+0xb35/0x1480
[ 107.562393][ T5969] exc_page_fault+0x6a/0xc0
[ 107.565383][ T5969] asm_exc_page_fault+0x26/0x30
[ 107.565412][ T5969] page last free pid 5968 tgid 5962 ts 107557380264 stack trace:
[ 107.565425][ T5969] __free_frozen_pages+0xc97/0xd90
[ 107.565441][ T5969] update_and_free_hugetlb_folio+0x17c/0x280
[ 107.565458][ T5969] folios_put_refs+0x73d/0xb30
[ 107.565480][ T5969] free_pages_and_swap_cache+0x41e/0x490
[ 107.565503][ T5969] tlb_flush_mmu+0x6d3/0xa30
[ 107.565520][ T5969] tlb_finish_mmu+0xf4/0x220
[ 107.565536][ T5969] zap_vma_range_batched+0x4b0/0x5a0
[ 107.565553][ T5969] madvise_vma_behavior+0x2361/0x43b0
[ 107.565571][ T5969] madvise_walk_vmas+0x924/0xb00
[ 107.565590][ T5969] madvise_do_behavior+0x385/0x540
[ 107.565609][ T5969] do_madvise+0x327/0x3a0
[ 107.565627][ T5969] __x64_sys_madvise+0xa6/0xc0
[ 107.565646][ T5969] do_syscall_64+0x166/0x520
[ 107.565664][ T5969] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.565681][ T5969] Modules linked in:
[ 107.565698][ T5969] CPU: 0 UID: 0 PID: 5969 Comm: syz-executor125 Tainted: G B syzkaller #0 PREEMPT(full)
[ 107.565720][ T5969] Tainted: [B]=BAD_PAGE
[ 107.565727][ T5969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 107.565736][ T5969] Call Trace:
[ 107.565743][ T5969]
[ 107.565750][ T5969] dump_stack_lvl+0xe8/0x150
[ 107.565776][ T5969] bad_page+0xdc/0x120
[ 107.565797][ T5969] __free_frozen_pages+0xd3b/0xd90
[ 107.565816][ T5969] update_and_free_hugetlb_folio+0x17c/0x280
[ 107.565835][ T5969] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 107.565852][ T5969] ? free_huge_folio+0xc6b/0xf20
[ 107.565873][ T5969] folios_put_refs+0x73d/0xb30
[ 107.565898][ T5969] ? __pfx_flush_tlb_func+0x10/0x10
[ 107.565914][ T5969] ? __pfx_folios_put_refs+0x10/0x10
[ 107.565935][ T5969] ? smp_call_function_many_cond+0x11b2/0x1500
[ 107.565969][ T5969] ? free_swap_cache+0x9b/0x300
[ 107.565992][ T5969] free_pages_and_swap_cache+0x41e/0x490
[ 107.566020][ T5969] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 107.566044][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566078][ T5969] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 107.566096][ T5969] ? __pfx___schedule+0x10/0x10
[ 107.566117][ T5969] ? preempt_schedule_thunk+0x16/0x40
[ 107.566140][ T5969] tlb_flush_mmu+0x6d3/0xa30
[ 107.566161][ T5969] tlb_finish_mmu+0xf4/0x220
[ 107.566181][ T5969] zap_vma_range_batched+0x4b0/0x5a0
[ 107.566211][ T5969] ? update_curr_dl_se+0x693/0x1340
[ 107.566233][ T5969] ? __pfx_zap_vma_range_batched+0x10/0x10
[ 107.566255][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566280][ T5969] ? madvise_vma_behavior+0x22d5/0x43b0
[ 107.566303][ T5969] madvise_vma_behavior+0x2361/0x43b0
[ 107.566330][ T5969] ? __pfx_madvise_vma_behavior+0x10/0x10
[ 107.566351][ T5969] ? clockevents_program_event+0x491/0x630
[ 107.566370][ T5969] ? trace_hrtimer_start+0x82/0x200
[ 107.566391][ T5969] ? __pfx_clockevents_program_event+0x10/0x10
[ 107.566408][ T5969] ? hrtimer_start_range_ns_common+0x7ab/0xb60
[ 107.566428][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566453][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566477][ T5969] ? trace_irq_enable+0x3b/0x140
[ 107.566502][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566527][ T5969] ? trace_sched_exit_tp+0x3a/0x130
[ 107.566553][ T5969] ? __schedule+0x17f3/0x5820
[ 107.566582][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566606][ T5969] ? lock_acquire+0x58/0x350
[ 107.566626][ T5969] ? irqentry_exit+0x2a0/0x9b0
[ 107.566650][ T5969] ? vma_start_read+0x2f8/0x5b0
[ 107.566674][ T5969] ? vma_start_read+0x368/0x5b0
[ 107.566701][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.566726][ T5969] ? lock_release+0x4b/0x3c0
[ 107.566748][ T5969] ? lock_vma_under_rcu+0x116/0x500
[ 107.566773][ T5969] ? lock_vma_under_rcu+0x45a/0x500
[ 107.566800][ T5969] ? __pfx_lock_vma_under_rcu+0x10/0x10
[ 107.566826][ T5969] ? trace_tlb_flush+0x3c/0x160
[ 107.566846][ T5969] madvise_walk_vmas+0x924/0xb00
[ 107.566867][ T5969] ? __pfx_flush_tlb_mm_range+0x10/0x10
[ 107.566883][ T5969] ? __pfx_madvise_walk_vmas+0x10/0x10
[ 107.566902][ T5969] ? blk_start_plug+0x6e/0x1b0
[ 107.566922][ T5969] madvise_do_behavior+0x385/0x540
[ 107.566952][ T5969] ? __pfx_madvise_do_behavior+0x10/0x10
[ 107.566976][ T5969] ? tlb_gather_mmu+0x22e/0x2f0
[ 107.566994][ T5969] do_madvise+0x327/0x3a0
[ 107.567014][ T5969] ? __pfx_do_madvise+0x10/0x10
[ 107.567031][ T5969] ? ktime_get_update_offsets_now+0x3bb/0x3f0
[ 107.567064][ T5969] ? rcu_is_watching+0x16/0xb0
[ 107.567092][ T5969] __x64_sys_madvise+0xa6/0xc0
[ 107.567111][ T5969] do_syscall_64+0x166/0x520
[ 107.567131][ T5969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.567148][ T5969] ? clear_bhb_loop+0x70/0xc0
[ 107.567168][ T5969] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.567186][ T5969] RIP: 0033:0x7f6a83c0bd37
[ 107.567202][ T5969] Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
[ 107.567216][ T5969] RSP: 002b:00007f6a80bd1178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
[ 107.567236][ T5969] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
[ 107.567250][ T5969] RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
[ 107.567262][ T5969] RBP: 0000000000000002 R08: 1999999999999999 R09: 0000000000000000
[ 107.567273][ T5969] R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
[ 107.567286][ T5969] R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
[ 107.567306][ T5969]
[ 109.352276][ T5967] BUG: Bad page state in process syz-executor125 pfn:63200
[ 109.352299][ T5967] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000200 pfn:0x63200
[ 109.352315][ T5967] head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
[ 109.352326][ T5967] flags: 0xfff00000000059(locked|uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
[ 109.352347][ T5967] raw: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 109.352359][ T5967] raw: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 109.352371][ T5967] head: 00fff00000000059 dead000000000100 dead000000000122 0000000000000000
[ 109.352383][ T5967] head: 0000000200000200 0000000000000000 00000000ffffffff 0000000000000000
[ 109.352394][ T5967] head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 109.352406][ T5967] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 109.352414][ T5967] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 109.352422][ T5967] page_owner tracks the page as allocated
[ 109.352428][ T5967] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5963, tgid 5962 (syz-executor125), ts 109350483319
[ 109.352455][ T5967] post_alloc_hook+0x1f9/0x250
[ 109.352475][ T5967] get_page_from_freelist+0x220f/0x2280
[ 109.352493][ T5967] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 109.352510][ T5967] only_alloc_fresh_hugetlb_folio+0x135/0x450
[ 109.352535][ T5967] alloc_surplus_hugetlb_folio+0xb9/0x350
[ 109.352557][ T5967] hugetlb_alloc_folio+0x568/0xb00
[ 109.352575][ T5967] alloc_hugetlb_folio+0x57c/0x900
[ 109.352593][ T5967] hugetlb_no_page+0xea5/0x16f0
[ 109.352613][ T5967] hugetlb_fault+0x776/0x1440
[ 109.352631][ T5967] handle_mm_fault+0x24fc/0x3750
[ 109.352651][ T5967] do_user_addr_fault+0xb35/0x1480
[ 109.352670][ T5967] exc_page_fault+0x6a/0xc0
[ 109.352687][ T5967] asm_exc_page_fault+0x26/0x30
[ 109.352703][ T5967] page last free pid 5968 tgid 5962 ts 109269011112 stack trace:
[ 109.352713][ T5967] __free_frozen_pages+0xc97/0xd90
[ 109.352728][ T5967] update_and_free_hugetlb_folio+0x17c/0x280
[ 109.352745][ T5967] folios_put_refs+0x73d/0xb30
[ 109.352769][ T5967] free_pages_and_swap_cache+0x41e/0x490
[ 109.352792][ T5967] tlb_flush_mmu+0x6d3/0xa30
[ 109.352808][ T5967] tlb_finish_mmu+0xf4/0x220
[ 109.352824][ T5967] zap_vma_range_batched+0x4b0/0x5a0
[ 109.352842][ T5967] madvise_vma_behavior+0x2361/0x43b0
[ 109.352862][ T5967] madvise_walk_vmas+0x924/0xb00
[ 109.352881][ T5967] madvise_do_behavior+0x385/0x540
[ 109.352900][ T5967] do_madvise+0x327/0x3a0
[ 109.352918][ T5967] __x64_sys_madvise+0xa6/0xc0
[ 109.352932][ T5967] do_syscall_64+0x166/0x520
[ 109.352947][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.352960][ T5967] Modules linked in:
[ 109.352976][ T5967] CPU: 0 UID: 0 PID: 5967 Comm: syz-executor125 Tainted: G B syzkaller #0 PREEMPT(full)
[ 109.352995][ T5967] Tainted: [B]=BAD_PAGE
[ 109.353000][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 109.353009][ T5967] Call Trace:
[ 109.353015][ T5967]
[ 109.353022][ T5967] dump_stack_lvl+0xe8/0x150
[ 109.353048][ T5967] bad_page+0xdc/0x120
[ 109.353070][ T5967] __free_frozen_pages+0xd3b/0xd90
[ 109.353088][ T5967] update_and_free_hugetlb_folio+0x17c/0x280
[ 109.353107][ T5967] ? __pfx_update_and_free_hugetlb_folio+0x10/0x10
[ 109.353126][ T5967] ? free_huge_folio+0xc6b/0xf20
[ 109.353158][ T5967] folios_put_refs+0x73d/0xb30
[ 109.353183][ T5967] ? __pfx_folios_put_refs+0x10/0x10
[ 109.353205][ T5967] ? smp_call_function_many_cond+0x11b2/0x1500
[ 109.353231][ T5967] ? free_swap_cache+0x9b/0x300
[ 109.353255][ T5967] free_pages_and_swap_cache+0x41e/0x490
[ 109.353285][ T5967] ? __pfx_free_pages_and_swap_cache+0x10/0x10
[ 109.353308][ T5967] ? rcu_is_watching+0x16/0xb0
[ 109.353339][ T5967] ? __pfx_flush_tlb_mm_range+0x10/0x10