program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c000440000000000000000b14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000018000380140000800800034000000002"], 0x44}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000780)={0x0, &(0x7f00000002c0)=[@nested_amd_stgi={0x17e, 0x10}, @uexit={0x0, 0x18, 0x8100000000000}, @enable_nested={0x12c, 0x18}, @nested_amd_vmload={0x182, 0x18, 0x3}, @in_dx={0x69, 0x20, {0x9f33, 0x1}}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @in_dx={0x69, 0x20, {0xb9d4, 0x4}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @code={0xa, 0x6c, {"c4a164145600b8010000000f01c1c744240094000000c744240200200000ff2c24670f01d1460fe242006567410f32260f01c266baf80cb8b87ff585ef66bafc0cb800000100ef67f20f0093790000000f20c035010000000f22c0"}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0x4d}, @wr_drn={0x68, 0x20, {0x4, 0x100000000}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x80000000, 0x1, 0x1}}, @nested_load_code={0x12e, 0x75, {0x0, "3e400f2096450f0050dcb9270a00000f32c744240013010000c744240240e40000ff1c24420f0179076465260f1656f845a4b9800000c00f3235001000000f3048b841050000000000000f23d80f21f835000000f00f23f866ba4300ed"}}, @out_dx={0x6a, 0x28, {0xba49, 0x1, 0xb}}, @rdmsr={0x66, 0x18, {0x844}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @control32=0x4002, 0xfffffffffffffffa, 0x7de, 0x1ff}}, @set_irq_handler={0xc8, 0x20, {0x46}}, @in_dx={0x69, 0x20, {0x8d7, 0x1}}, @nested_load_code={0x12e, 0x67, {0x2, "0f20c035000000800f22c0450fc76a0d66b8b6000f00d8d9f5f2450f2105c4e20592b4f9a10600000f0171b248b8a1700000000000000f23d00f21f835300000040f23f82666f2420f70db0c65dbc1"}}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x460, 0x81, 0x0, 0x8}}, @wr_crn={0x67, 0x20, {0x4, 0x9}}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0xf54d, 0x1, 0x1}}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xf7, 0x5, 0x8, 0x1}}, @nested_vmlaunch={0x12f, 0x18, 0x7}], 0x490}) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f00000007c0)={0x20000, 0x0, {[0x8, 0x7, 0x9, 0x4, 0x5, 0x3, 0x5, 0x4]}}) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000280)='/dev/bsg/1:0:0:0\x00', 0x404002, 0x0) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x181001, 0x0) ioctl$COMEDI_BUFINFO(r4, 0xc02c640e, &(0x7f00000001c0)={0x1, 0x0, 0xf6, 0x4, 0x6, 0x9}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r6, 0x2000) r7 = syz_open_dev$loop(&(0x7f0000000000), 0xffffffff, 0x500) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f00000000c0)={r5, 0xf730, {0x0, 0x0, 0x0, 0x7fff, 0x1, 0x0, 0x2, 0x5, 0x15, "46e032ee67acc5915591d2b7f2bdf128f59e94b2e7580aa4678403e4d0cbb4d359259f939cc3372283852ccb695ac5ec9308176b260f4757d774ef3a0c43574d", "3e447163db0fdca19763aa23eb196e30365ad453e30e4a7670f85dfeb1cabad811a6cb2d3ea3b0f2ec22b0075ecf3fa20c26c59311be11f0469ae9e6534f96e5", "f7b5dbd699dea39fdd2b634879497c24488eb2f757146b04118863ce5783ab9e", [0x1, 0x5]}}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) bind$inet6(r3, &(0x7f0000000840)={0xa, 0x4e20, 0x9, @rand_addr=' \x01\x00'}, 0x1c) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000240)=0x1) ioctl$BLKBSZSET(r5, 0x40081271, &(0x7f0000000200)=0x10000) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x4080, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0xfe929fbf8425633a, @perf_bp={0x0, 0x1}, 0x100000, 0x0, 0xb, 0x4, 0x4, 0x1000000, 0xfffb, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x800000000, 0xffffffffffffffff, 0x0) [ 93.797491][ T4653] Bluetooth: hci0: command tx timeout [ 93.890239][ T5332] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.919315][ T5332] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.152039][ T5335] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x6 pfn:0x4468c [ 94.165957][ T5335] memcg:ffff888012cf4280 [ 94.170153][ T5335] flags: 0x4fff00000000001(locked|node=1|zone=1|lastcpupid=0x7ff) [ 94.182711][ T5335] raw: 04fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 94.199370][ T5335] raw: 0000000000000006 0000000000000000 00000001ffffffff ffff888012cf4280 [ 94.213014][ T5335] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 94.220033][ T5335] page_owner tracks the page as allocated [ 94.227897][ T5335] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5335, tgid 5331 (syz.0.0), ts 94152001765, free_ts 94127782177 [ 94.245722][ T5335] post_alloc_hook+0x1f9/0x250 [ 94.250745][ T5335] get_page_from_freelist+0x21fa/0x2270 [ 94.257191][ T5335] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.263071][ T5335] alloc_pages_mpol+0x212/0x380 [ 94.267151][ T5335] alloc_pages_noprof+0xac/0x2a0 [ 94.274304][ T5335] folio_alloc_noprof+0x1e/0x30 [ 94.282242][ T5335] filemap_alloc_folio_noprof+0x111/0x470 [ 94.296957][ T5335] page_cache_ra_order+0x569/0xee0 [ 94.311767][ T5335] do_sync_mmap_readahead+0x75e/0x990 [ 94.317027][ T5335] filemap_fault+0x7d9/0x13b0 [ 94.322117][ T5335] __do_fault+0x138/0x2a0 [ 94.332727][ T5335] do_pte_missing+0x2215/0x34b0 [ 94.345797][ T5335] handle_mm_fault+0x1b36/0x3080 [ 94.354642][ T5335] do_user_addr_fault+0x744/0x1340 [ 94.359280][ T5335] exc_page_fault+0x6a/0xc0 [ 94.364287][ T5335] asm_exc_page_fault+0x26/0x30 [ 94.379622][ T5335] page last free pid 5333 tgid 5331 stack trace: [ 94.387172][ T5335] free_unref_folios+0xd84/0x14a0 [ 94.392120][ T5335] folios_put_refs+0x9e9/0xb30 [ 94.396476][ T5335] truncate_inode_pages_range+0x3ca/0xd80 [ 94.401070][ T5335] set_blocksize+0x2ce/0x440 [ 94.405495][ T5335] blkdev_bszset+0x1b2/0x230 [ 94.409934][ T5335] blkdev_ioctl+0x2c7/0x740 [ 94.414352][ T5335] __se_sys_ioctl+0xfc/0x170 [ 94.417290][ T5335] do_syscall_64+0x174/0x580 [ 94.425574][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.428497][ T5335] ------------[ cut here ]------------ [ 94.431396][ T5335] kernel BUG at mm/filemap.c:859! [ 94.436115][ T5335] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 94.438984][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.443086][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.447488][ T5335] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 94.450028][ T5335] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 ec a2 20 ff 90 0f 0b e8 34 a8 bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 d3 a2 20 ff 90 <0f> 0b e8 1b a8 bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 bc a2 20 ff [ 94.457954][ T5335] RSP: 0018:ffffc9000f687280 EFLAGS: 00010246 [ 94.460461][ T5335] RAX: b75e078b79de1400 RBX: 0000000000000000 RCX: 0000000000000000 [ 94.463465][ T5335] RDX: 0000000000000007 RSI: ffffffff8e230467 RDI: 00000000ffffffff [ 94.466712][ T5335] RBP: ffffc9000f687400 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 94.469941][ T5335] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: dffffc0000000000 [ 94.473166][ T5335] R13: ffff8880325908c0 R14: 0000000000000004 R15: ffff8880325909d8 [ 94.476419][ T5335] FS: 00007fdb3567a6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 94.480006][ T5335] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.482817][ T5335] CR2: 00007fb76586b218 CR3: 0000000012fa1000 CR4: 0000000000352ef0 [ 94.486090][ T5335] Call Trace: [ 94.487472][ T5335] [ 94.488681][ T5335] ? percpu_ref_put+0x19/0x180 [ 94.490723][ T5335] ? __pfx___filemap_add_folio+0x10/0x10 [ 94.493106][ T5335] ? percpu_ref_put+0x19/0x180 [ 94.495099][ T5335] ? percpu_ref_put+0xf9/0x180 [ 94.497060][ T5335] filemap_add_folio+0x25e/0x530 [ 94.499029][ T5335] page_cache_ra_order+0x6d1/0xee0 [ 94.501220][ T5335] do_sync_mmap_readahead+0x75e/0x990 [ 94.503345][ T5335] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 94.505737][ T5335] ? count_memcg_event_mm+0x1d/0x250 [ 94.507881][ T5335] ? count_memcg_event_mm+0x1d/0x250 [ 94.509912][ T5335] filemap_fault+0x7d9/0x13b0 [ 94.511687][ T5335] ? __pfx_filemap_fault+0x10/0x10 [ 94.513898][ T5335] ? __pfx_filemap_map_pages+0x10/0x10 [ 94.516182][ T5335] __do_fault+0x138/0x2a0 [ 94.517906][ T5335] ? do_pte_missing+0x140c/0x34b0 [ 94.519923][ T5335] do_pte_missing+0x2215/0x34b0 [ 94.522007][ T5335] ? handle_mm_fault+0xec/0x3080 [ 94.524058][ T5335] handle_mm_fault+0x1b36/0x3080 [ 94.526098][ T5335] ? handle_mm_fault+0xec/0x3080 [ 94.528173][ T5335] ? __pfx_handle_mm_fault+0x10/0x10 [ 94.530294][ T5335] ? lock_mm_and_find_vma+0xa7/0x340 [ 94.532463][ T5335] do_user_addr_fault+0x744/0x1340 [ 94.534559][ T5335] exc_page_fault+0x6a/0xc0 [ 94.536387][ T5335] asm_exc_page_fault+0x26/0x30 [ 94.538345][ T5335] RIP: 0010:__get_user_4+0x14/0x30 [ 94.540426][ T5335] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca e9 50 5c 04 00 90 90 90 90 90 90 90 90 90 90 [ 94.548052][ T5335] RSP: 0018:ffffc9000f687ca8 EFLAGS: 00050287 [ 94.550539][ T5335] RAX: 0000200000000044 RBX: ffffc9000f687da0 RCX: 0000000000000046 [ 94.553839][ T5335] RDX: 00007ffffffff000 RSI: ffffffff8e4b597e RDI: ffffffff8c4bed80 [ 94.557323][ T5335] RBP: ffffc9000f687ee0 R08: ffffffff821d9aaf R09: 0000000000000000 [ 94.560999][ T5335] R10: 0000000000000000 R11: ffff8880124a5cf8 R12: 1ffff92001ed0fb0 [ 94.564101][ T5335] R13: 0000200000000044 R14: ffffc9000f687da0 R15: 0000200000000040 [ 94.567224][ T5335] ? __might_fault+0xaf/0x130 [ 94.569000][ T5335] perf_copy_attr+0x45/0x860 [ 94.570809][ T5335] __se_sys_perf_event_open+0x107/0x1d40 [ 94.573027][ T5335] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.575149][ T5335] ? __pfx___se_sys_perf_event_open+0x10/0x10 [ 94.577497][ T5335] ? __pfx_kcov_ioctl+0x10/0x10 [ 94.579481][ T5335] ? __x64_sys_perf_event_open+0x20/0xc0 [ 94.581835][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.584229][ T5335] do_syscall_64+0x174/0x580 [ 94.586050][ T5335] ? trace_irq_disable+0x3b/0x140 [ 94.588086][ T5335] ? clear_bhb_loop+0x40/0x90 [ 94.589892][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.592332][ T5335] RIP: 0033:0x7fdb3479df99 [ 94.594143][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.601744][ T5335] RSP: 002b:00007fdb35679fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 94.605161][ T5335] RAX: ffffffffffffffda RBX: 00007fdb34a26180 RCX: 00007fdb3479df99 [ 94.608349][ T5335] RDX: 0000000800000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 94.611434][ T5335] RBP: 00007fdb34834ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.614554][ T5335] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 94.617775][ T5335] R13: 00007fdb34a26218 R14: 00007fdb34a26180 R15: 00007ffc44bb1538 [ 94.621073][ T5335] [ 94.622307][ T5335] Modules linked in: [ 94.624896][ T5335] ---[ end trace 0000000000000000 ]--- [ 94.637907][ T5335] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 94.640776][ T5335] Code: ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 ec a2 20 ff 90 0f 0b e8 34 a8 bf ff 48 8b 7c 24 08 48 c7 c6 20 01 f8 8b e8 d3 a2 20 ff 90 <0f> 0b e8 1b a8 bf ff 4c 89 f7 48 c7 c6 60 0c f8 8b e8 bc a2 20 ff [ 94.649132][ T5335] RSP: 0018:ffffc9000f687280 EFLAGS: 00010246 [ 94.651975][ T5335] RAX: b75e078b79de1400 RBX: 0000000000000000 RCX: 0000000000000000 [ 94.655507][ T5335] RDX: 0000000000000007 RSI: ffffffff8e230467 RDI: 00000000ffffffff [ 94.658895][ T5335] RBP: ffffc9000f687400 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 94.662332][ T5335] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: dffffc0000000000 [ 94.665849][ T5335] R13: ffff8880325908c0 R14: 0000000000000004 R15: ffff8880325909d8 [ 94.669304][ T5335] FS: 00007fdb3567a6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 94.673275][ T5335] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.676556][ T5335] CR2: 00007fdb355556a0 CR3: 0000000012fa1000 CR4: 0000000000352ef0 [ 94.679713][ T5335] Kernel panic - not syncing: Fatal exception [ 94.682791][ T5335] Kernel Offset: disabled [ 94.684485][ T5335] Rebooting in 86400 seconds..