program: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) (async) io_uring_enter(r2, 0x71d3, 0x2d81, 0x11, &(0x7f0000000040)={[0xe7b2]}, 0x8) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000017, 0x38011, r3, 0x4000) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40081271, &(0x7f0000000980)=0x4000) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) (async) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) (async) r5 = io_uring_setup(0x2cb8, &(0x7f0000000600)={0x0, 0xc837, 0x8, 0x3, 0x1d8}) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000001a80)={0x0, 0x0, 0x3}, 0x1) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async, rerun: 32) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (rerun: 32) lseek(r6, 0x851, 0x0) [ 87.521882][ T5305] Bluetooth: hci0: command tx timeout [ 87.525933][ T10] cfg80211: failed to load regulatory.db [ 87.624569][ T5327] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x23 pfn:0x4c379 [ 87.628335][ T5327] memcg:ffff88801bed0d00 [ 87.652340][ T5327] flags: 0x4fff00000000001(locked|node=1|zone=1|lastcpupid=0x7ff) [ 87.655846][ T5327] raw: 04fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 87.659514][ T5327] raw: 0000000000000023 0000000000000000 00000001ffffffff ffff88801bed0d00 [ 87.681698][ T5327] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 87.685515][ T5327] page_owner tracks the page as allocated [ 87.687717][ T5327] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5327, tgid 5327 (syz.0.0), ts 87624546794, free_ts 87624147120 [ 87.706915][ T5327] post_alloc_hook+0x240/0x2a0 [ 87.708844][ T5327] get_page_from_freelist+0x2365/0x2440 [ 87.711151][ T5327] __alloc_frozen_pages_noprof+0x181/0x370 [ 87.714288][ T5327] alloc_pages_mpol+0x232/0x4a0 [ 87.716512][ T5327] alloc_pages_noprof+0xa9/0x190 [ 87.718797][ T5327] folio_alloc_noprof+0x1e/0x30 [ 87.721017][ T5327] filemap_alloc_folio_noprof+0xdf/0x470 [ 87.724677][ T5327] page_cache_ra_order+0x55b/0xe70 [ 87.726999][ T5327] do_sync_mmap_readahead+0x25e/0x7a0 [ 87.729470][ T5327] filemap_fault+0x6b9/0x12b0 [ 87.732056][ T5327] __do_fault+0x138/0x390 [ 87.733968][ T5327] __handle_mm_fault+0x1847/0x5400 [ 87.736112][ T5327] handle_mm_fault+0x40a/0x8e0 [ 87.738294][ T5327] do_user_addr_fault+0xa7c/0x1380 [ 87.740660][ T5327] exc_page_fault+0x82/0x100 [ 87.743312][ T5327] asm_exc_page_fault+0x26/0x30 [ 87.745275][ T5327] page last free pid 5328 tgid 5327 stack trace: [ 87.748058][ T5327] free_unref_folios+0xdb3/0x14f0 [ 87.750126][ T5327] folios_put_refs+0x584/0x670 [ 87.754456][ T5327] truncate_inode_pages_range+0x346/0xda0 [ 87.756872][ T5327] set_blocksize+0x32a/0x500 [ 87.758637][ T5327] blkdev_bszset+0x1ac/0x220 [ 87.760527][ T5327] blkdev_ioctl+0x437/0x6d0 [ 87.762839][ T5327] __se_sys_ioctl+0xfc/0x170 [ 87.765240][ T5327] do_syscall_64+0xfa/0xfa0 [ 87.767104][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.770320][ T5327] ------------[ cut here ]------------ [ 87.772893][ T5327] kernel BUG at mm/filemap.c:871! [ 87.775502][ T5327] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 87.778101][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.781819][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 87.786483][ T5327] RIP: 0010:__filemap_add_folio+0x11ad/0x12f0 [ 87.789175][ T5327] Code: 8b c6 ff 4c 89 e7 48 c7 c6 00 75 74 8b e8 7b 63 2e ff 90 0f 0b e8 03 8b c6 ff 4c 89 e7 48 c7 c6 e0 6b 74 8b e8 64 63 2e ff 90 <0f> 0b e8 ec 8a c6 ff 4c 89 e7 48 c7 c6 00 75 74 8b e8 4d 63 2e ff [ 87.797220][ T5327] RSP: 0018:ffffc9000d1d7680 EFLAGS: 00010246 [ 87.799833][ T5327] RAX: ffeec572a6a07200 RBX: 0000000000000000 RCX: 0000000000000000 [ 87.803350][ T5327] RDX: 0000000000000007 RSI: ffffffff8d7100d2 RDI: 00000000ffffffff [ 87.806714][ T5327] RBP: ffffc9000d1d77e8 R08: ffffffff8f7cfb77 R09: 1ffffffff1ef9f6e [ 87.809984][ T5327] R10: dffffc0000000000 R11: fffffbfff1ef9f6f R12: ffffea000130de40 [ 87.813372][ T5327] R13: dffffc0000000000 R14: ffffea000130de48 R15: 0000000000000002 [ 87.816742][ T5327] FS: 000055556474d500(0000) GS:ffff88808d732000(0000) knlGS:0000000000000000 [ 87.820242][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.822666][ T5327] CR2: 00007fe5edcc6ad0 CR3: 0000000041026000 CR4: 0000000000352ef0 [ 87.825760][ T5327] Call Trace: [ 87.827232][ T5327] [ 87.828589][ T5327] ? percpu_ref_put+0x19/0x180 [ 87.830683][ T5327] ? __pfx___filemap_add_folio+0x10/0x10 [ 87.833368][ T5327] ? percpu_ref_put+0xf9/0x180 [ 87.835587][ T5327] filemap_add_folio+0x26d/0x540 [ 87.837724][ T5327] page_cache_ra_order+0x6bc/0xe70 [ 87.839898][ T5327] do_sync_mmap_readahead+0x25e/0x7a0 [ 87.842180][ T5327] ? __pfx_do_sync_mmap_readahead+0x10/0x10 [ 87.844620][ T5327] ? count_memcg_event_mm+0x1d/0x250 [ 87.846919][ T5327] ? count_memcg_event_mm+0x1d/0x250 [ 87.849120][ T5327] filemap_fault+0x6b9/0x12b0 [ 87.851095][ T5327] ? __pfx_filemap_fault+0x10/0x10 [ 87.853267][ T5327] __do_fault+0x138/0x390 [ 87.855065][ T5327] __handle_mm_fault+0x1847/0x5400 [ 87.857259][ T5327] ? lock_vma_under_rcu+0x1a3/0x450 [ 87.859456][ T5327] ? __pfx___handle_mm_fault+0x10/0x10 [ 87.861822][ T5327] ? lock_vma_under_rcu+0x3d2/0x450 [ 87.864010][ T5327] ? __pfx_do_futex+0x10/0x10 [ 87.866016][ T5327] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 87.868381][ T5327] handle_mm_fault+0x40a/0x8e0 [ 87.870420][ T5327] do_user_addr_fault+0xa7c/0x1380 [ 87.872648][ T5327] ? rcu_is_watching+0x15/0xb0 [ 87.874579][ T5327] ? trace_page_fault_user+0x84/0x1e0 [ 87.876708][ T5327] exc_page_fault+0x82/0x100 [ 87.878730][ T5327] asm_exc_page_fault+0x26/0x30 [ 87.880838][ T5327] RIP: 0033:0x7f9bc76654b9 [ 87.882733][ T5327] Code: ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 c8 fe ff ff e8 68 59 0c 00 85 c0 75 10 48 8b 44 24 68 48 8b b4 24 98 00 00 00 <48> 89 30 64 f0 83 2c 25 90 ff ff ff 01 48 8b 84 24 80 00 00 00 48 [ 87.889951][ T5327] RSP: 002b:00007fff79e782e0 EFLAGS: 00010246 [ 87.892593][ T5327] RAX: 00002000000002c0 RBX: 0000000000000002 RCX: ffffffffffffe8ff [ 87.895965][ T5327] RDX: 299369d50ed7e820 RSI: 0000200000001700 RDI: 000055556474d3c8 [ 87.899181][ T5327] RBP: 0000000000000002 R08: 00007f9bc75ff02c R09: 000000000000005c [ 87.902459][ T5327] R10: 0000000000000000 R11: 0000000000000001 R12: 00007f9bc79e618c [ 87.905973][ T5327] R13: 00007f9bc79e6180 R14: fffffffffffffffe R15: 0000000000000005 [ 87.909163][ T5327] [ 87.910515][ T5327] Modules linked in: [ 87.912629][ T5327] ---[ end trace 0000000000000000 ]--- [ 87.918914][ T5327] RIP: 0010:__filemap_add_folio+0x11ad/0x12f0 [ 87.923079][ T5327] Code: 8b c6 ff 4c 89 e7 48 c7 c6 00 75 74 8b e8 7b 63 2e ff 90 0f 0b e8 03 8b c6 ff 4c 89 e7 48 c7 c6 e0 6b 74 8b e8 64 63 2e ff 90 <0f> 0b e8 ec 8a c6 ff 4c 89 e7 48 c7 c6 00 75 74 8b e8 4d 63 2e ff [ 87.932068][ T5327] RSP: 0018:ffffc9000d1d7680 EFLAGS: 00010246 [ 87.934634][ T5327] RAX: ffeec572a6a07200 RBX: 0000000000000000 RCX: 0000000000000000 [ 87.938163][ T5327] RDX: 0000000000000007 RSI: ffffffff8d7100d2 RDI: 00000000ffffffff [ 87.942464][ T5327] RBP: ffffc9000d1d77e8 R08: ffffffff8f7cfb77 R09: 1ffffffff1ef9f6e [ 87.945942][ T5327] R10: dffffc0000000000 R11: fffffbfff1ef9f6f R12: ffffea000130de40 [ 87.949297][ T5327] R13: dffffc0000000000 R14: ffffea000130de48 R15: 0000000000000002 [ 87.953310][ T5327] FS: 000055556474d500(0000) GS:ffff88808d732000(0000) knlGS:0000000000000000 [ 87.957108][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.959856][ T5327] CR2: 00007fe5edcc6ad0 CR3: 0000000041026000 CR4: 0000000000352ef0 [ 87.964261][ T5327] Kernel panic - not syncing: Fatal exception [ 87.967563][ T5327] Kernel Offset: disabled [ 87.969486][ T5327] Rebooting in 86400 seconds..