BUG: Bad page state in hugetlb_no_page

Status: upstream: reported C repro on 2026/10/28 22:52
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+d06e9fe6d6a7b537fe49@syzkaller.appspotmail.com
Fix commit: mm/hugetlb: fix use-after-free of a new anon folio
Patched on: [], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 4d09h, last: 1d14h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
990e12bd repro-c Reproduced: ✅ ❓ BUG: Bad page state in hugetlb_no_page 2026/10/27 07:04 2026/10/27 07:05 2026/10/27 08:51 168cb7a2
572a1a3e assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: Bad page state in hugetlb_no_page 2026/10/26 04:04 2026/10/26 04:04 2026/10/26 04:46 1d9ca40b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] BUG: Bad page state in hugetlb_no_page 0 (2) 2026/10/29 07:09
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/27 16:41 42m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git d135ab453a7400a34930bdda1ef4bdc8acfac80e report job log log

Sample crash report:
BUG: Bad page state in process syz-executor125  pfn:60600
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000a00 pfn:0x60600
head: order:0 mapcount:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000058(uptodate|dirty|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000
raw: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000
head: 00fff00000000058 dead000000000100 dead000000000122 0000000000000000
head: 0000000200000a00 0000000000000002 00000000ffffffff 0000000000000000
head: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5964, tgid 5962 (syz-executor125), ts 99736440450
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1854
 prep_new_page mm/page_alloc.c:1862 [inline]
 get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3933
 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5429
 alloc_buddy_frozen_folio mm/hugetlb.c:1811 [inline]
 only_alloc_fresh_hugetlb_folio+0x135/0x450 mm/hugetlb.c:1852
 alloc_fresh_hugetlb_folio mm/hugetlb.c:1871 [inline]
 alloc_surplus_hugetlb_folio+0xb9/0x350 mm/hugetlb.c:2103
 alloc_buddy_hugetlb_folio mm/hugetlb.c:2183 [inline]
 hugetlb_alloc_folio+0x568/0xb00 mm/hugetlb.c:2899
 alloc_hugetlb_folio+0x57c/0x900 mm/hugetlb.c:3067
 hugetlb_no_page+0xea5/0x16f0 mm/hugetlb.c:5875
 hugetlb_fault+0x776/0x1440 mm/hugetlb.c:-1
 handle_mm_fault+0x24fc/0x3750 mm/memory.c:6844
 do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
page last free pid 5968 tgid 5962 ts 99714065632 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1401 [inline]
 __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2952
 update_and_free_hugetlb_folio+0x17c/0x280 mm/hugetlb.c:1568
 folios_put_refs+0x73d/0xb30 mm/folio.c:1020
 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:647
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:404
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:529
 zap_vma_range_batched+0x4b0/0x5a0 mm/memory.c:2321
 madvise_dontneed_single_vma mm/madvise.c:873 [inline]
 madvise_dontneed_free mm/madvise.c:964 [inline]
 madvise_vma_behavior+0x2361/0x43b0 mm/madvise.c:1375
 madvise_walk_vmas+0x924/0xb00 mm/madvise.c:1692
 madvise_do_behavior+0x385/0x540 mm/madvise.c:1921
 do_madvise+0x327/0x3a0 mm/madvise.c:2019
 __do_sys_madvise mm/madvise.c:2028 [inline]
 __se_sys_madvise mm/madvise.c:2026 [inline]
 __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:2026
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 5970 Comm: syz-executor125 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 bad_page+0xdc/0x120 mm/page_alloc.c:630
 free_page_is_bad mm/page_alloc.c:1065 [inline]
 __free_pages_prepare mm/page_alloc.c:1392 [inline]
 __free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2952
 update_and_free_hugetlb_folio+0x17c/0x280 mm/hugetlb.c:1568
 folios_put_refs+0x73d/0xb30 mm/folio.c:1020
 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:647
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:404
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:529
 zap_vma_range_batched+0x4b0/0x5a0 mm/memory.c:2321
 madvise_dontneed_single_vma mm/madvise.c:873 [inline]
 madvise_dontneed_free mm/madvise.c:964 [inline]
 madvise_vma_behavior+0x2361/0x43b0 mm/madvise.c:1375
 madvise_walk_vmas+0x924/0xb00 mm/madvise.c:1692
 madvise_do_behavior+0x385/0x540 mm/madvise.c:1921
 do_madvise+0x327/0x3a0 mm/madvise.c:2019
 __do_sys_madvise mm/madvise.c:2028 [inline]
 __se_sys_madvise mm/madvise.c:2026 [inline]
 __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:2026
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a83c0bd37
Code: 8b 54 24 78 64 48 2b 14 25 28 00 00 00 75 0a 48 81 c4 88 00 00 00 5b 5d c3 e8 05 0d 00 00 0f 1f 44 00 00 b8 1c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6a803d0178 EFLAGS: 00000202 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6a83c0bd37
RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000200000000000
RBP: 0000000000000003 R08: 1999999999999999 R09: 0000000000000000
R10: 00007f6a83c85220 R11: 0000000000000202 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffe29fa7790 R15: 00007ffe29fa7878
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/27 17:23 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git d135ab453a74 1d9ca40b .config console log report C ci-upstream-kasan-gce BUG: Bad page state in hugetlb_no_page
2026/10/24 22:47 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: Bad page state in hugetlb_no_page
* Struck through repros no longer work on HEAD.