BUG: Bad page state in process syz-executor125 pfn:60600 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000a00 pfn:0x60600 head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000058(uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000 raw: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000 head: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000 head: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000 head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000 head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5964, tgid 5962 (syz-executor125), ts 99736440450 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1854 prep_new_page mm/page_alloc.c:1862 [inline] get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3933 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5429 alloc_buddy_frozen_folio mm/hugetlb.c:1811 [inline] only_alloc_fresh_hugetlb_folio+0x135/0x450 mm/hugetlb.c:1852 alloc_fresh_hugetlb_folio mm/hugetlb.c:1871 [inline] alloc_surplus_hugetlb_folio+0xb9/0x350 mm/hugetlb.c:2103 alloc_buddy_hugetlb_folio mm/hugetlb.c:2183 [inline] hugetlb_alloc_folio+0x568/0xb00 mm/hugetlb.c:2899 alloc_hugetlb_folio+0x57c/0x900 mm/hugetlb.c:3067 hugetlb_no_page+0xea5/0x16f0 mm/hugetlb.c:5875 hugetlb_fault+0x776/0x1440 mm/hugetlb.c:-1 handle_mm_fault+0x24fc/0x3750 mm/memory.c:6844 do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 page last free pid 5968 tgid 5962 ts 99714065632 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1401 [inline] __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2952 update_and_free_hugetlb_folio+0x17c/0x280 mm/hugetlb.c:1568 folios_put_refs+0x73d/0xb30 mm/folio.c:1020 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:647 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:397 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:404 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:529 zap_vma_range_batched+0x4b0/0x5a0 mm/memory.c:2321 madvise_dontneed_single_vma mm/madvise.c:873 [inline] madvise_dontneed_free mm/madvise.c:964 [inline] madvise_vma_behavior+0x2361/0x43b0 mm/madvise.c:1375 madvise_walk_vmas+0x924/0xb00 mm/madvise.c:1692 madvise_do_behavior+0x385/0x540 mm/madvise.c:1921 do_madvise+0x327/0x3a0 mm/madvise.c:2019 __do_sys_madvise mm/madvise.c:2028 [inline] __se_sys_madvise mm/madvise.c:2026 [inline] __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:2026 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 1 UID: 0 PID: 5970 Comm: syz-executor125 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 bad_page+0xdc/0x120 mm/page_alloc.c:630 free_page_is_bad mm/page_alloc.c:1065 [inline] __free_pages_prepare mm/page_alloc.c:1392 [inline] __free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2952 update_and_free_hugetlb_folio+0x17c/0x280 mm/hugetlb.c:1568 folios_put_refs+0x73d/0xb30 mm/folio.c:1020 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:647 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:397 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:404 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:529 zap_vma_range_batched+0x4b0/0x5a0 mm/memory.c:2321 madvise_dontneed_single_vma mm/madvise.c:873 [inline] madvise_dontneed_free mm/madvise.c:964 [inline] madvise_vma_behavior+0x2361/0x43b0 mm/madvise.c:1375 madvise_walk_vmas+0x924/0xb00 mm/madvise.c:1692 madvise_do_behavior+0x385/0x540 mm/madvise.c:1921 do_madvise+0x327/0x3a0 mm/madvise.c:2019 __do_sys_madvise mm/madvise.c:2028 [inline] __se_sys_madvise mm/madvise.c:2026 [inline] __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:2026 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6a83c0bd37 Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6a803d0178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37 RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 0000000000000003 R08: 1999999999999999 R09: 0000000000000000 R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0 R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878