syzbot


BUG: Bad page map (9)

Status: moderation: reported on 2025/12/21 01:29
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+32d7126a82fa127794b1@syzkaller.appspotmail.com
First crash: 6d01h, last: 6d01h
Similar bugs (20)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: Bad page map (3) -1 3 383d 529d 0/2 auto-obsoleted due to no activity on 2025/03/04 10:23
android-5-10 BUG: Bad page map -1 1 1021d 1021d 0/2 auto-obsoleted due to no activity on 2023/06/05 15:46
linux-4.19 BUG: Bad page map (3) -1 1 1253d 1253d 0/1 auto-obsoleted due to no activity on 2022/11/15 21:40
upstream BUG: Bad page map (5) mm 19 C 35 1073d 1331d 22/29 fixed on 2023/02/24 13:50
android-5-15 BUG: Bad page map -1 1 535d 535d 0/2 auto-obsoleted due to no activity on 2024/10/03 11:06
linux-4.19 BUG: Bad page map (2) -1 10 1439d 1619d 0/1 auto-closed as invalid on 2022/05/13 11:22
android-54 BUG: Bad page map (3) -1 10 564d 681d 0/2 auto-obsoleted due to no activity on 2024/09/04 10:38
upstream BUG: Bad page map (2) mm -1 syz 127 2665d 2721d 0/29 closed as invalid on 2018/09/05 12:51
upstream BUG: Bad page map (8) mm -1 C done done 10 339d 522d 0/29 auto-obsoleted due to no activity on 2025/04/27 22:16
android-5-10 BUG: Bad page map (2) -1 1 802d 802d 0/2 auto-obsoleted due to no activity on 2024/01/10 02:50
upstream BUG: Bad page map mm -1 1 2724d 2724d 0/29 closed as invalid on 2018/07/08 13:28
upstream BUG: Bad page map (3) kernel -1 4 2535d 2660d 0/29 auto-closed as invalid on 2019/07/13 00:02
linux-4.19 BUG: Bad page map -1 2 1936d 1995d 0/1 auto-closed as invalid on 2021/01/01 08:20
upstream BUG: Bad page map (7) mm -1 C done 19 813d 835d 25/29 fixed on 2023/12/21 03:45
android-54 BUG: Bad page map (2) -1 7 802d 920d 0/2 auto-obsoleted due to no activity on 2024/01/10 18:32
upstream BUG: Bad page map (4) mm -1 39 1480d 2117d 0/29 auto-closed as invalid on 2022/04/02 04:25
linux-4.14 BUG: Bad page map -1 1 1982d 1982d 0/1 auto-closed as invalid on 2020/11/16 16:05
android-54 BUG: Bad page map (4) -1 18 221d 321d 0/2 auto-obsoleted due to no activity on 2025/08/04 13:44
upstream BUG: Bad page map (6) mm -1 1 987d 983d 0/29 auto-obsoleted due to no activity on 2023/07/09 13:20
android-54 BUG: Bad page map -1 1 1215d 1215d 0/2 auto-obsoleted due to no activity on 2022/12/23 04:05

Sample crash report:
BUG: Bad page map in process syz.1.5005  pte:80000000abe00007
pgd:800000006ed2c067 p4d:800000006ed2c067 pud:6ed2b067 pmd:8a983067
page: refcount:1 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000001fffffffe 0000000000000000
page dumped because: bad page map
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
 __vmalloc_area_node mm/vmalloc.c:3863 [inline]
 __vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
 kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
 folios_put_refs+0x4be/0x750 mm/swap.c:1002
 free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu mm/mmu_gather.c:404 [inline]
 tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
 vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
 vms_clean_up_area mm/vma.c:1250 [inline]
 __mmap_setup mm/vma.c:2403 [inline]
 __mmap_region+0x627/0x2a00 mm/vma.c:2690
 mmap_region+0x1ab/0x3f0 mm/vma.c:2786
 do_mmap+0xa3e/0x1210 mm/mmap.c:558
 vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
 ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
addr:00007f0851dfd000 vm_flags:180400fb anon_vma:0000000000000000 mapping:ffff888149090728 index:200
file:kcov fault:0x0 mmap:kcov_mmap mmap_prepare: 0x0 read_folio:0x0
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G     U  W    L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 print_bad_page_map mm/memory.c:612 [inline]
 print_bad_page_map+0x4b5/0xa00 mm/memory.c:586
 zap_present_folio_ptes mm/memory.c:1653 [inline]
 zap_present_ptes mm/memory.c:1708 [inline]
 do_zap_pte_range mm/memory.c:1810 [inline]
 zap_pte_range mm/memory.c:1854 [inline]
 zap_pmd_range mm/memory.c:1946 [inline]
 zap_pud_range mm/memory.c:1975 [inline]
 zap_p4d_range mm/memory.c:1996 [inline]
 unmap_page_range+0x1c5d/0x43c0 mm/memory.c:2017
 unmap_single_vma+0x153/0x240 mm/memory.c:2059
 unmap_vmas+0x218/0x470 mm/memory.c:2101
 exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
 __mmput+0x12a/0x410 kernel/fork.c:1173
 mmput+0x62/0x70 kernel/fork.c:1196
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x7d7/0x2bd0 kernel/exit.c:959
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
 get_signal+0x2671/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
 </TASK>
BUG: Bad page state in process syz.1.5005  pfn:abe00
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: nonzero mapcount
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
 __vmalloc_area_node mm/vmalloc.c:3863 [inline]
 __vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
 kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
 folios_put_refs+0x4be/0x750 mm/swap.c:1002
 free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu mm/mmu_gather.c:404 [inline]
 tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
 vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
 vms_clean_up_area mm/vma.c:1250 [inline]
 __mmap_setup mm/vma.c:2403 [inline]
 __mmap_region+0x627/0x2a00 mm/vma.c:2690
 mmap_region+0x1ab/0x3f0 mm/vma.c:2786
 do_mmap+0xa3e/0x1210 mm/mmap.c:558
 vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
 ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G    BU  W    L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 bad_page+0xcf/0x220 mm/page_alloc.c:650
 free_page_is_bad mm/page_alloc.c:1083 [inline]
 free_page_is_bad mm/page_alloc.c:1077 [inline]
 free_pages_prepare mm/page_alloc.c:1387 [inline]
 free_unref_folios+0xb43/0x1610 mm/page_alloc.c:3000
 folios_put_refs+0x4be/0x750 mm/swap.c:1002
 free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu+0xe9/0x5a0 mm/mmu_gather.c:404
 zap_pte_range mm/memory.c:1893 [inline]
 zap_pmd_range mm/memory.c:1946 [inline]
 zap_pud_range mm/memory.c:1975 [inline]
 zap_p4d_range mm/memory.c:1996 [inline]
 unmap_page_range+0x1e64/0x43c0 mm/memory.c:2017
 unmap_single_vma+0x153/0x240 mm/memory.c:2059
 unmap_vmas+0x218/0x470 mm/memory.c:2101
 exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
 __mmput+0x12a/0x410 kernel/fork.c:1173
 mmput+0x62/0x70 kernel/fork.c:1196
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x7d7/0x2bd0 kernel/exit.c:959
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
 get_signal+0x2671/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
 </TASK>
page: refcount:0 mapcount:-1 mapping:0000000000000000 index:0x200 pfn:0xabe00
flags: 0xfff00000000014(referenced|dirty|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000014 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000200 0000000000000000 00000000fffffffe 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 19188, tgid 19188 (syz-executor), ts 780491487850, free_ts 758750405403
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
 __vmalloc_area_node mm/vmalloc.c:3863 [inline]
 __vmalloc_node_range_noprof+0xe6c/0x16b0 mm/vmalloc.c:4051
 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4205
 kcov_ioctl+0x4c/0x6e0 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 18705 tgid 18703 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
 folios_put_refs+0x4be/0x750 mm/swap.c:1002
 free_pages_and_swap_cache+0x3f0/0x4a0 mm/swap_state.c:358
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu mm/mmu_gather.c:404 [inline]
 tlb_finish_mmu+0x168/0x7c0 mm/mmu_gather.c:497
 vms_clear_ptes+0x55a/0x790 mm/vma.c:1238
 vms_clean_up_area mm/vma.c:1250 [inline]
 __mmap_setup mm/vma.c:2403 [inline]
 __mmap_region+0x627/0x2a00 mm/vma.c:2690
 mmap_region+0x1ab/0x3f0 mm/vma.c:2786
 do_mmap+0xa3e/0x1210 mm/mmap.c:558
 vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
 ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1288!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 30016 Comm: syz.1.5005 Tainted: G    BU  W    L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE, [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS:  0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a8e9d5f820 CR3: 000000003589a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 vfree+0x1fd/0xb50 mm/vmalloc.c:3466
 kcov_put kernel/kcov.c:439 [inline]
 kcov_put kernel/kcov.c:435 [inline]
 kcov_close+0x34/0x60 kernel/kcov.c:535
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x87f/0x2bd0 kernel/exit.c:971
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
 get_signal+0x2671/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f085258f7c9
Code: Unable to access opcode bytes at 0x7f085258f79f.
RSP: 002b:00007f08507f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000117
RAX: fffffffffffffff2 RBX: 00007f08527e5fa0 RCX: 00007f085258f7c9
RDX: 0000000000000000 RSI: 0002000000000003 RDI: 0000000000000001
RBP: 00007f0852613f91 R08: 0000000000000000 R09: 8000400000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f08527e6038 R14: 00007f08527e5fa0 R15: 00007ffd4533f808
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:1288 [inline]
RIP: 0010:put_page_testzero include/linux/mm.h:1286 [inline]
RIP: 0010:___free_pages+0x1e5/0x220 mm/page_alloc.c:5290
Code: 0f 94 c6 e9 b6 fe ff ff 48 c7 c6 20 f9 9c 8b 4c 89 ef e8 2e a6 ef ff 90 0f 0b 48 c7 c6 c0 0c 9d 8b 4c 89 ef e8 1c a6 ef ff 90 <0f> 0b 48 89 df e8 11 a1 0e 00 e9 c0 fe ff ff e8 37 a1 0e 00 e9 2f
RSP: 0018:ffffc9000bd0f998 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea0002af8034 RCX: 0000000000000000
RDX: ffff888076f45b80 RSI: ffffffff82189374 RDI: ffff888076f46004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff9088e2d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffea0002af8000 R14: 0000000000000000 R15: ffff88814d29eb00
FS:  0000000000000000(0000) GS:ffff8881248fd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fca7f4d5feb CR3: 000000007c89a000 CR4: 00000000003526f0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/17 01:27 upstream 40fbbd64bba6 d1b870e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto BUG: Bad page map
* Struck through repros no longer work on HEAD.