program:
r0 = socket$nl_route(0x10, 0x3, 0x0)
open(&(0x7f0000000100)='./file0\x00', 0x101bff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4)
r1 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0)
fcntl$setsig(r1, 0xa, 0x11)
fcntl$setlease(r1, 0x400, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x161842, 0x0)
r2 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0)
fcntl$setlease(r2, 0x400, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0)
mq_open(0x0, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x80000040001})
r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000000)='\x00', 0x1, 0xfffffffffffffffe)
r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000040)={r4, r5, r5}, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={'poly1305-generic\x00'}})
r6 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r6, 0x10d, 0xe, &(0x7f00001c9fff)="03", 0x1)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000fb7963a8bef765e7e5230db1fbae25ace90000000000001000000000000000", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b0000000000"], 0x28}}, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000240)={'wlan1\x00', <r9=>0x0})
r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="2400000983e8380e3f54b0fe21a27ae897c702005b6955edeaa3a84eee4264e46b192d59eada7a7ac917eabbeec2f611cf02972d9d23f5c55acdb9e89b7280d2789606e5b8842c80cf5fbd63e1acadbc34baaed6e9cc22fc2cc9230fe82e7b5b5dd1cf4622383d0b6df0b8fe0c96c7aa382a2dfb3aec8c2dde7adb61e7134dd2d92855e2a04c05495cb0854e3aa97f54f83d8b9edc32f100"/164, @ANYRES16=r10, @ANYBLOB="010000000000000000008900000008000300", @ANYRES32=r9, @ANYBLOB="08001d8004000000"], 0x24}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
ioctl(r7, 0x8b1a, &(0x7f0000000480)="e091e2d555f23cfd866773d827c07ffbffd8ccb18210106cbf6d7adfb12fd7f0b2ec13d9916be01146e9b3edc44d0780c964c58273cd0497a4410fce1ade7635ef6d5477ccb77075124681134d1d0117fcbc94e83e6688b02b89649b0712287c49cd4faa5558943b253dd8b5b66c7dfc42fdd6c7d7eeba8e4fa1926b96487b27a343be690a997c868d3ac7169592e4915ee25343300c50aa0000445038c5ad2075e3e247ba5434b9f4798f8ae2b6eb839f5ea546a2e077d25553dd378dfb49923731963af0faef955ba30c2bacc9e8cb3272080b6c7ca698bed06bcb51af0d6cab10a592d800bbac092029bb95f7f06aa37d163df1175a0000000000000000948f85176a0c3d628e89c1c7b95f2256f35a1ab94d9a53c9a598c2a3036ec98b5d4411e8c88777b2ac9fe368c61e1688657df9fcbc70fef19e0893fa72605d682cf9571309a3a063e43dbace47d1c6f019b9bfb984e1")
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)

[   69.313165][ T5308] Bluetooth: hci0: command tx timeout
[   69.607601][ T5325] page: refcount:3 mapcount:1 mapping:ffff8880532c5200 index:0x360 pfn:0x53417
[   69.611772][ T5325] memcg:ffff888034144000
[   69.613492][ T5325] aops:shmem_aops ino:4
[   69.615255][ T5325] flags: 0x4fff6800002002d(locked|referenced|uptodate|lru|swapbacked|node=1|zone=1|lastcpupid=0x7ff)
[   69.620394][ T5325] raw: 04fff6800002002d ffffea00014d0588 ffffea00014d0608 ffff8880532c5200
[   69.623478][ T5325] raw: 0000000000000360 0000000000000000 0000000300000000 ffff888034144000
[   69.626622][ T5325] page dumped because: VM_BUG_ON_FOLIO(folio_mapped(folio))
[   69.629650][ T5325] page_owner tracks the page as allocated
[   69.632782][ T5325] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5323, tgid 5322 (syz.0.0), ts 69442015743, free_ts 0
[   69.638968][ T5325]  post_alloc_hook+0x1f4/0x240
[   69.640967][ T5325]  get_page_from_freelist+0x365c/0x37a0
[   69.643098][ T5325]  __alloc_frozen_pages_noprof+0x292/0x710
[   69.645514][ T5325]  alloc_pages_mpol+0x311/0x660
[   69.647788][ T5325]  folio_alloc_mpol_noprof+0x36/0x70
[   69.650188][ T5325]  shmem_alloc_and_add_folio+0x4a0/0x1090
[   69.652853][ T5325]  shmem_get_folio_gfp+0x621/0x1840
[   69.655048][ T5325]  shmem_fault+0x220/0x5b0
[   69.656878][ T5325]  __do_fault+0x135/0x390
[   69.658656][ T5325]  __handle_mm_fault+0x4c44/0x70f0
[   69.660773][ T5325]  handle_mm_fault+0x3e5/0x8d0
[   69.665173][ T5325]  __get_user_pages+0x1a92/0x4140
[   69.667545][ T5325]  populate_vma_page_range+0x264/0x330
[   69.669727][ T5325]  __mm_populate+0x27a/0x460
[   69.671611][ T5325]  vm_mmap_pgoff+0x303/0x430
[   69.673310][ T5325]  do_syscall_64+0xf3/0x230
[   69.675048][ T5325] page_owner free stack trace missing
[   69.677395][ T5325] ------------[ cut here ]------------
[   69.679891][ T5325] kernel BUG at mm/filemap.c:154!
[   69.682425][ T5325] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
[   69.685311][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.14.0-rc2-syzkaller-00056-gab68d7eb7b1a #0
[   69.689525][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   69.694496][ T5325] RIP: 0010:filemap_unaccount_folio+0x73d/0x7d0
[   69.697221][ T5325] Code: de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 fb f3 11 00 90 0f 0b e8 a3 de c7 ff 48 89 df 48 c7 c6 c0 d2 13 8c e8 e4 f3 11 00 90 <0f> 0b e8 8c de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 cd f3 11 00
[   69.704643][ T5325] RSP: 0018:ffffc9000d437490 EFLAGS: 00010046
[   69.707559][ T5325] RAX: 73ab402b2582f000 RBX: ffffea00014d05c0 RCX: ffffc9000d437003
[   69.711373][ T5325] RDX: 0000000000000002 RSI: ffffffff8c0ab8e0 RDI: ffffffff8c608cc0
[   69.714571][ T5325] RBP: 0000000000000000 R08: ffffffff901b6077 R09: 1ffffffff2036c0e
[   69.717572][ T5325] R10: dffffc0000000000 R11: fffffbfff2036c0f R12: dffffc0000000000
[   69.720755][ T5325] R13: 1ffffd400029a0b9 R14: ffff8880532c5200 R15: ffffea00014d05c8
[   69.723745][ T5325] FS:  00007f64cb1336c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
[   69.727672][ T5325] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   69.731298][ T5325] CR2: 000040000026f100 CR3: 000000003d8ba000 CR4: 0000000000352ef0
[   69.734871][ T5325] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   69.738002][ T5325] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   69.741623][ T5325] Call Trace:
[   69.743241][ T5325]  <TASK>
[   69.744469][ T5325]  ? __die_body+0x5f/0xb0
[   69.746217][ T5325]  ? die+0x9e/0xc0
[   69.747739][ T5325]  ? do_trap+0x15a/0x3a0
[   69.749402][ T5325]  ? filemap_unaccount_folio+0x73d/0x7d0
[   69.751731][ T5325]  ? do_error_trap+0x1dc/0x2c0
[   69.753662][ T5325]  ? filemap_unaccount_folio+0x73d/0x7d0
[   69.756041][ T5325]  ? __pfx_do_error_trap+0x10/0x10
[   69.758283][ T5325]  ? report_bug+0x3cd/0x500
[   69.760075][ T5325]  ? handle_invalid_op+0x34/0x40
[   69.762354][ T5325]  ? filemap_unaccount_folio+0x73d/0x7d0
[   69.764811][ T5325]  ? exc_invalid_op+0x38/0x50
[   69.766841][ T5325]  ? asm_exc_invalid_op+0x1a/0x20
[   69.769421][ T5325]  ? filemap_unaccount_folio+0x73d/0x7d0
[   69.772244][ T5325]  __filemap_remove_folio+0xc7/0x670
[   69.774576][ T5325]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   69.777111][ T5325]  ? __pfx___filemap_remove_folio+0x10/0x10
[   69.779907][ T5325]  ? _raw_spin_lock_irq+0xdf/0x120
[   69.782166][ T5325]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[   69.784353][ T5325]  ? do_raw_spin_unlock+0x58/0x8b0
[   69.786467][ T5325]  filemap_remove_folio+0xe1/0x1f0
[   69.788458][ T5325]  truncate_inode_folio+0x5d/0x70
[   69.790603][ T5325]  shmem_undo_range+0x44b/0x1820
[   69.792779][ T5325]  ? __pfx_shmem_undo_range+0x10/0x10
[   69.794942][ T5325]  ? __pfx_validate_chain+0x10/0x10
[   69.797083][ T5325]  ? percpu_counter_add_batch+0xff/0x1f0
[   69.799581][ T5325]  shmem_evict_inode+0x29b/0xa80
[   69.801686][ T5325]  ? inode_wait_for_writeback+0x111/0x2a0
[   69.803934][ T5325]  ? __pfx_shmem_evict_inode+0x10/0x10
[   69.806144][ T5325]  ? do_raw_spin_unlock+0x58/0x8b0
[   69.808310][ T5325]  ? __pfx_shmem_evict_inode+0x10/0x10
[   69.810630][ T5325]  evict+0x4e8/0x9a0
[   69.812182][ T5325]  ? __pfx_evict+0x10/0x10
[   69.814039][ T5325]  ? iput+0x713/0xa50
[   69.815804][ T5325]  __dentry_kill+0x20d/0x630
[   69.817932][ T5325]  ? dput+0x37/0x2b0
[   69.819668][ T5325]  dput+0x19f/0x2b0
[   69.821514][ T5325]  __fput+0x60b/0x9f0
[   69.823214][ T5325]  task_work_run+0x24f/0x310
[   69.825242][ T5325]  ? __pfx_task_work_run+0x10/0x10
[   69.827346][ T5325]  ? syscall_exit_to_user_mode+0xa3/0x340
[   69.829877][ T5325]  syscall_exit_to_user_mode+0x13f/0x340
[   69.832499][ T5325]  do_syscall_64+0x100/0x230
[   69.834638][ T5325]  ? clear_bhb_loop+0x35/0x90
[   69.836958][ T5325]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   69.839571][ T5325] RIP: 0033:0x7f64ca38cde9
[   69.841506][ T5325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   69.849568][ T5325] RSP: 002b:00007f64cb133038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[   69.853659][ T5325] RAX: 0000400000000000 RBX: 00007f64ca5a6160 RCX: 00007f64ca38cde9
[   69.856916][ T5325] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000400000000000
[   69.859813][ T5325] RBP: 00007f64ca40e2a0 R08: 0000000000000007 R09: 0000000000000000
[   69.863114][ T5325] R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
[   69.866971][ T5325] R13: 0000000000000001 R14: 00007f64ca5a6160 R15: 00007ffe3b6507b8
[   69.870430][ T5325]  </TASK>
[   69.871610][ T5325] Modules linked in:
[   69.873069][ T5325] ---[ end trace 0000000000000000 ]---
[   69.875060][ T5325] RIP: 0010:filemap_unaccount_folio+0x73d/0x7d0
[   69.877556][ T5325] Code: de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 fb f3 11 00 90 0f 0b e8 a3 de c7 ff 48 89 df 48 c7 c6 c0 d2 13 8c e8 e4 f3 11 00 90 <0f> 0b e8 8c de c7 ff 48 89 df 48 c7 c6 e0 d3 13 8c e8 cd f3 11 00
[   69.887330][ T5325] RSP: 0018:ffffc9000d437490 EFLAGS: 00010046
[   69.889960][ T5325] RAX: 73ab402b2582f000 RBX: ffffea00014d05c0 RCX: ffffc9000d437003
[   69.893388][ T5325] RDX: 0000000000000002 RSI: ffffffff8c0ab8e0 RDI: ffffffff8c608cc0
[   69.897276][ T5325] RBP: 0000000000000000 R08: ffffffff901b6077 R09: 1ffffffff2036c0e
[   69.901103][ T5325] R10: dffffc0000000000 R11: fffffbfff2036c0f R12: dffffc0000000000
[   69.904565][ T5325] R13: 1ffffd400029a0b9 R14: ffff8880532c5200 R15: ffffea00014d05c8
[   69.907711][ T5325] FS:  00007f64cb1336c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
[   69.911526][ T5325] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   69.914505][ T5325] CR2: 000040000026f100 CR3: 000000003d8ba000 CR4: 0000000000352ef0
[   69.917874][ T5325] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   69.920854][ T5325] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   69.923783][ T5325] Kernel panic - not syncing: Fatal exception
[   69.926459][ T5325] Kernel Offset: disabled
[   69.928592][ T5325] Rebooting in 86400 seconds..