program: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x7}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xb7, &(0x7f000000cf3d)=""/183, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1}, 0x10}, 0x94) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xca72, 0xc000, 0x0, 0x20002fb}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r2 = dup(r1) ioctl$FS_IOC_SETFLAGS(r2, 0x40081271, &(0x7f0000000040)=0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r2, 0x2c93a000) openat(r2, &(0x7f0000001300)='./file0\x00', 0x1, 0x8) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f0000000180)={'pcl812\x00', [0x100, 0x3ff, 0x80000, 0x2, 0x4, 0x1, 0x1, 0x4006, 0x8, 0xa, 0x0, 0x8, 0x1, 0x401, 0x9, 0x0, 0x2, 0x8, 0x7, 0x401, 0x7, 0x2, 0x4, 0x9, 0x48, 0x7, 0x7, 0x0, 0x81, 0x7, 0x8]}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001200)=0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r5, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) syz_clone3(&(0x7f0000001280)={0x100000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), {0x41}, &(0x7f0000000140)=""/169, 0xa9, &(0x7f0000000200)=""/4096, &(0x7f0000001240)=[r4, 0x0, 0x0, 0xffffffffffffffff], 0x4, {r2}}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x7}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xb7, &(0x7f000000cf3d)=""/183, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1}, 0x10}, 0x94) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async) io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xca72, 0xc000, 0x0, 0x20002fb}) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) (async) dup(r1) (async) ioctl$FS_IOC_SETFLAGS(r2, 0x40081271, &(0x7f0000000040)=0x4000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r2, 0x2c93a000) (async) openat(r2, &(0x7f0000001300)='./file0\x00', 0x1, 0x8) (async) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) (async) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f0000000180)={'pcl812\x00', [0x100, 0x3ff, 0x80000, 0x2, 0x4, 0x1, 0x1, 0x4006, 0x8, 0xa, 0x0, 0x8, 0x1, 0x401, 0x9, 0x0, 0x2, 0x8, 0x7, 0x401, 0x7, 0x2, 0x4, 0x9, 0x48, 0x7, 0x7, 0x0, 0x81, 0x7, 0x8]}) (async) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001200)) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) (async) ioctl$FS_IOC_RESVSP(r5, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) (async) syz_clone3(&(0x7f0000001280)={0x100000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), {0x41}, &(0x7f0000000140)=""/169, 0xa9, &(0x7f0000000200)=""/4096, &(0x7f0000001240)=[r4, 0x0, 0x0, 0xffffffffffffffff], 0x4, {r2}}, 0x58) (async) [ 109.190594][ T5289] Bluetooth: hci0: command tx timeout [ 109.267168][ T5332] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880333366c0 pfn:0x33336 [ 109.295000][ T5332] memcg:ffff8880333d3300 [ 109.303153][ T5332] flags: 0x4fff00000000001(locked|node=1|zone=1|lastcpupid=0x7ff) [ 109.310337][ T5332] raw: 04fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 109.320518][ T5332] raw: ffff8880333366c0 0000000000000000 00000001ffffffff ffff8880333d3300 [ 109.329432][ T5332] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 109.336875][ T5332] page_owner tracks the page as allocated [ 109.341723][ T5332] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5332, tgid 5330 (syz.0.0), ts 109267114232, free_ts 109254413275 [ 109.361339][ T5332] post_alloc_hook+0x1f9/0x250 [ 109.370546][ T5332] get_page_from_freelist+0x21fa/0x2270 [ 109.374840][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380 [ 109.380129][ T5332] alloc_pages_mpol+0x212/0x380 [ 109.386676][ T5332] alloc_pages_noprof+0xac/0x2a0 [ 109.390917][ T5332] folio_alloc_noprof+0x1e/0x30 [ 109.394054][ T5332] filemap_alloc_folio_noprof+0x111/0x470 [ 109.396946][ T5332] page_cache_ra_order+0x569/0xee0 [ 109.399217][ T5332] do_sync_mmap_readahead+0x75e/0x990 [ 109.401524][ T5332] filemap_fault+0x7d9/0x13b0 [ 109.403780][ T5332] __do_fault+0x138/0x2a0 [ 109.405696][ T5332] do_pte_missing+0x2215/0x34b0 [ 109.408106][ T5332] handle_mm_fault+0x1b36/0x3080 [ 109.410628][ T5332] __get_user_pages+0x1678/0x2720 [ 109.413199][ T5332] populate_vma_page_range+0x2be/0x3c0 [ 109.415736][ T5332] __mm_populate+0x25f/0x390 [ 109.417915][ T5332] page last free pid 52 tgid 52 stack trace: [ 109.420939][ T5332] __free_frozen_pages+0xc1e/0xd10 [ 109.423633][ T5332] __slab_free+0x274/0x2c0 [ 109.425750][ T5332] qlist_free_all+0x99/0x100 [ 109.427925][ T5332] kasan_quarantine_reduce+0x148/0x160 [ 109.430642][ T5332] __kasan_slab_alloc+0x22/0x80 [ 109.433662][ T5332] kmem_cache_alloc_node_noprof+0x355/0x610 [ 109.437250][ T5332] __alloc_skb+0x1d7/0x7a0 [ 109.442524][ T5332] mld_newpack+0x165/0xcb0 [ 109.444463][ T5332] add_grec+0x119f/0x19d0 [ 109.446426][ T5332] mld_send_initial_cr+0x288/0x550 [ 109.449505][ T5332] ipv6_mc_dad_complete+0x87/0x540 [ 109.452587][ T5332] addrconf_dad_completed+0x8af/0xe60 [ 109.455217][ T5332] addrconf_dad_work+0xcf8/0x15c0 [ 109.457298][ T5332] process_scheduled_works+0xa8e/0x14e0 [ 109.459579][ T5332] worker_thread+0xa47/0xfb0 [ 109.462007][ T5332] kthread+0x388/0x470 [ 109.464901][ T5332] ------------[ cut here ]------------ [ 109.467447][ T5332] kernel BUG at mm/filemap.c:859! [ 109.469776][ T5332] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 109.472764][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 109.480525][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.484398][ T5332] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 109.486785][ T5332] Code: ff 4c 89 f7 48 c7 c6 60 0b d8 8b e8 3c 53 21 ff 90 0f 0b e8 24 b6 bf ff 48 8b 7c 24 08 48 c7 c6 20 00 d8 8b e8 23 53 21 ff 90 <0f> 0b e8 0b b6 bf ff 4c 89 f7 48 c7 c6 60 0b d8 8b e8 0c 53 21 ff [ 109.494886][ T5332] RSP: 0018:ffffc9000e3af1c0 EFLAGS: 00010246 [ 109.497463][ T5332] RAX: 2fa1cb4322a7df00 RBX: 0000000000000000 RCX: 0000000000000000 [ 109.501068][ T5332] RDX: 0000000000000007 RSI: ffffffff8dfe928a RDI: 00000000ffffffff [ 109.504834][ T5332] RBP: ffffc9000e3af340 R08: ffffffff90331ef7 R09: 1ffffffff20663de [ 109.508132][ T5332] R10: dffffc0000000000 R11: fffffbfff20663df R12: dffffc0000000000 [ 109.511283][ T5332] R13: ffff888000ce1fc0 R14: 0000000000000002 R15: ffff888000ce20d8 [ 109.514698][ T5332] FS: 00007f89724bc6c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 109.519314][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.522040][ T5332] CR2: 0000000000000000 CR3: 0000000043e43000 CR4: 0000000000352ef0 [ 109.525499][ T5332] Call Trace: [ 109.527157][ T5332] [ 109.528749][ T5332] ? percpu_ref_put+0x19/0x180 [ 109.531034][ T5332] ? __pfx___filemap_add_folio+0x10/0x10 [ 109.533468][ T5332] ? percpu_ref_put+0x19/0x180 [ 109.535483][ T5332] ? percpu_ref_put+0xf9/0x180 [ 109.537297][ T5332] filemap_add_folio+0x25e/0x530 [ 109.539415][ T5332] page_cache_ra_order+0x6d1/0xee0 [ 109.542038][ T5332] do_sync_mmap_readahead+0x75e/0x990 [ 109.544428][ T5332] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 109.547049][ T5332] ? count_memcg_event_mm+0x1d/0x250 [ 109.549268][ T5332] ? count_memcg_event_mm+0x1d/0x250 [ 109.551622][ T5332] filemap_fault+0x7d9/0x13b0 [ 109.553783][ T5332] ? __pfx_filemap_fault+0x10/0x10 [ 109.556220][ T5332] ? __pfx_filemap_map_pages+0x10/0x10 [ 109.558845][ T5332] __do_fault+0x138/0x2a0 [ 109.560994][ T5332] ? do_pte_missing+0x140c/0x34b0 [ 109.563697][ T5332] do_pte_missing+0x2215/0x34b0 [ 109.566251][ T5332] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 109.569693][ T5332] ? mtree_range_walk+0x707/0x8b0 [ 109.572766][ T5332] handle_mm_fault+0x1b36/0x3080 [ 109.575088][ T5332] ? mt_find+0x186/0x630 [ 109.577219][ T5332] ? handle_mm_fault+0xec/0x3080 [ 109.579762][ T5332] ? __pfx_handle_mm_fault+0x10/0x10 [ 109.582368][ T5332] __get_user_pages+0x1678/0x2720 [ 109.585121][ T5332] populate_vma_page_range+0x2be/0x3c0 [ 109.588115][ T5332] ? __pfx_populate_vma_page_range+0x10/0x10 [ 109.590972][ T5332] ? down_read+0x2be/0x330 [ 109.592875][ T5332] __mm_populate+0x25f/0x390 [ 109.594987][ T5332] ? __pfx___mm_populate+0x10/0x10 [ 109.597292][ T5332] vm_mmap_pgoff+0x353/0x4e0 [ 109.600004][ T5332] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 109.602636][ T5332] ? __fget_files+0x2a/0x420 [ 109.604754][ T5332] ? __fget_files+0x3a2/0x420 [ 109.606664][ T5332] ? __fget_files+0x2a/0x420 [ 109.608606][ T5332] ksys_mmap_pgoff+0x4dc/0x760 [ 109.610733][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.613716][ T5332] do_syscall_64+0x174/0x580 [ 109.616135][ T5332] ? trace_irq_disable+0x3b/0x140 [ 109.618651][ T5332] ? clear_bhb_loop+0x40/0x90 [ 109.620755][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.623285][ T5332] RIP: 0033:0x7f897159de59 [ 109.625604][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.634275][ T5332] RSP: 002b:00007f89724bbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 109.637855][ T5332] RAX: ffffffffffffffda RBX: 00007f8971826090 RCX: 00007f897159de59 [ 109.641683][ T5332] RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 109.645008][ T5332] RBP: 00007f8971633e6f R08: 0000000000000005 R09: 000000002c93a000 [ 109.648418][ T5332] R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000 [ 109.652052][ T5332] R13: 00007f8971826128 R14: 00007f8971826090 R15: 00007ffebfb03cc8 [ 109.655933][ T5332] [ 109.657281][ T5332] Modules linked in: [ 109.660121][ T5332] ---[ end trace 0000000000000000 ]--- [ 109.684994][ T5332] RIP: 0010:__filemap_add_folio+0x11ee/0x1360 [ 109.688188][ T5332] Code: ff 4c 89 f7 48 c7 c6 60 0b d8 8b e8 3c 53 21 ff 90 0f 0b e8 24 b6 bf ff 48 8b 7c 24 08 48 c7 c6 20 00 d8 8b e8 23 53 21 ff 90 <0f> 0b e8 0b b6 bf ff 4c 89 f7 48 c7 c6 60 0b d8 8b e8 0c 53 21 ff [ 109.697880][ T5332] RSP: 0018:ffffc9000e3af1c0 EFLAGS: 00010246 [ 109.700733][ T5332] RAX: 2fa1cb4322a7df00 RBX: 0000000000000000 RCX: 0000000000000000 [ 109.705236][ T5332] RDX: 0000000000000007 RSI: ffffffff8dfe928a RDI: 00000000ffffffff [ 109.709541][ T5332] RBP: ffffc9000e3af340 R08: ffffffff90331ef7 R09: 1ffffffff20663de [ 109.713060][ T5332] R10: dffffc0000000000 R11: fffffbfff20663df R12: dffffc0000000000 [ 109.716500][ T5332] R13: ffff888000ce1fc0 R14: 0000000000000002 R15: ffff888000ce20d8 [ 109.720225][ T5332] FS: 00007f89724bc6c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 109.724654][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.728205][ T5332] CR2: 0000000000000000 CR3: 0000000043e43000 CR4: 0000000000352ef0 [ 109.733016][ T5332] Kernel panic - not syncing: Fatal exception [ 109.736386][ T5332] Kernel Offset: disabled [ 109.738935][ T5332] Rebooting in 86400 seconds..