ERROR: (device loop3): remounting filesystem as read-only
ERROR: (device loop3): txCommit: 
blkno = 8f7c0, nblocks = 1
ERROR: (device loop3): dbUpdatePMap: blocks are outside the map
ERROR: (device loop3): remounting filesystem as read-only
BUG: Bad page state in process syz.3.20  pfn:75b8a
page:ffffea0001d6e280 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1a pfn:0x75b8a
flags: 0xfff0000000820d(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff0000000820d dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001a ffff88807cab50f8 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 5946, tgid 5945 (syz.3.20), ts 76306058871, free_ts 75963255326
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
 filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
 do_read_cache_folio+0x36c/0x7e0 mm/filemap.c:3768
 do_read_cache_page+0x32/0x250 mm/filemap.c:3870
 read_mapping_page include/linux/pagemap.h:892 [inline]
 __get_metapage+0x31a/0xfa0 fs/jfs/jfs_metapage.c:620
 diReadSpecial+0x25b/0x710 fs/jfs/jfs_imap.c:447
 duplicateIXtree+0x10e/0x480 fs/jfs/jfs_imap.c:2993
 diNewIAG fs/jfs/jfs_imap.c:2597 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0x1795/0x1de0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1660 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x950 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x191/0xa30 fs/jfs/namei.c:225
 vfs_mkdir+0x296/0x440 fs/namei.c:4121
 do_mkdirat+0x1d4/0x440 fs/namei.c:4144
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc_lru+0x115/0x2e0 mm/slub.c:3526
 alloc_inode_sb include/linux/fs.h:2946 [inline]
 sock_alloc_inode+0x28/0xc0 net/socket.c:308
 alloc_inode fs/inode.c:261 [inline]
 new_inode_pseudo+0x63/0x1d0 fs/inode.c:1049
 sock_alloc net/socket.c:634 [inline]
 __sock_create+0x12d/0x940 net/socket.c:1535
 sock_create net/socket.c:1627 [inline]
 __sys_socket_create net/socket.c:1664 [inline]
 __sys_socket+0xd7/0x1a0 net/socket.c:1715
 __do_sys_socket net/socket.c:1729 [inline]
 __se_sys_socket net/socket.c:1727 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1727
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
Modules linked in:
CPU: 1 PID: 5946 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 bad_page+0x14b/0x170 mm/page_alloc.c:512
 free_page_is_bad mm/page_alloc.c:961 [inline]
 free_pages_prepare mm/page_alloc.c:1146 [inline]
 free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 txUnlock+0x27e/0xcb0 fs/jfs/jfs_txnmgr.c:933
 txCommit+0x4dbd/0x5250 fs/jfs/jfs_txnmgr.c:1336
 duplicateIXtree+0x293/0x480 fs/jfs/jfs_imap.c:3019
 diNewIAG fs/jfs/jfs_imap.c:2597 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0x1795/0x1de0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1660 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x950 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x191/0xa30 fs/jfs/namei.c:225
 vfs_mkdir+0x296/0x440 fs/namei.c:4121
 do_mkdirat+0x1d4/0x440 fs/namei.c:4144
 __do_sys_mkdirat fs/namei.c:4159 [inline]
 __se_sys_mkdirat fs/namei.c:4157 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4157
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1698f8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1699e3d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f16991e5fa0 RCX: 00007f1698f8f749
RDX: 0000000000000000 RSI: 0000200000000840 RDI: ffffffffffffff9c
RBP: 00007f1699013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f16991e6038 R14: 00007f16991e5fa0 R15: 00007fff83350ba8
 </TASK>
page:ffffea0001d6e280 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1a pfn:0x75b8a
flags: 0xfff0000000820d(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff0000000820d dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001a ffff88807cab50f8 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 5946, tgid 5945 (syz.3.20), ts 76306058871, free_ts 75963255326
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 folio_alloc+0x1e/0x30 mm/mempolicy.c:2291
 filemap_alloc_folio+0xdf/0x470 mm/filemap.c:1004
 do_read_cache_folio+0x36c/0x7e0 mm/filemap.c:3768
 do_read_cache_page+0x32/0x250 mm/filemap.c:3870
 read_mapping_page include/linux/pagemap.h:892 [inline]
 __get_metapage+0x31a/0xfa0 fs/jfs/jfs_metapage.c:620
 diReadSpecial+0x25b/0x710 fs/jfs/jfs_imap.c:447
 duplicateIXtree+0x10e/0x480 fs/jfs/jfs_imap.c:2993
 diNewIAG fs/jfs/jfs_imap.c:2597 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0x1795/0x1de0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1660 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x950 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x191/0xa30 fs/jfs/namei.c:225
 vfs_mkdir+0x296/0x440 fs/namei.c:4121
 do_mkdirat+0x1d4/0x440 fs/namei.c:4144
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc_lru+0x115/0x2e0 mm/slub.c:3526
 alloc_inode_sb include/linux/fs.h:2946 [inline]
 sock_alloc_inode+0x28/0xc0 net/socket.c:308
 alloc_inode fs/inode.c:261 [inline]
 new_inode_pseudo+0x63/0x1d0 fs/inode.c:1049
 sock_alloc net/socket.c:634 [inline]
 __sock_create+0x12d/0x940 net/socket.c:1535
 sock_create net/socket.c:1627 [inline]
 __sys_socket_create net/socket.c:1664 [inline]
 __sys_socket+0xd7/0x1a0 net/socket.c:1715
 __do_sys_socket net/socket.c:1729 [inline]
 __se_sys_socket net/socket.c:1727 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1727
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1458!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5946 Comm: syz.3.20 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:folio_get include/linux/mm.h:1458 [inline]
RIP: 0010:get_page include/linux/mm.h:1464 [inline]
RIP: 0010:put_metapage+0x253/0x340 fs/jfs/jfs_metapage.c:750
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 07 1a dd fe e9 25 ff ff ff e8 5d ab 85 fe 48 8b 3c 24 48 c7 c6 00 f8 e3 8a e8 0d 80 c5 fe <0f> 0b f3 0f 1e fa 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff
RSP: 0018:ffffc90003587560 EFLAGS: 00010246
RAX: 803f9364bb11a000 RBX: ffff88807cab50f8 RCX: 803f9364bb11a000
RDX: 0000000000000000 RSI: ffffffff8afc6f20 RDI: ffffffff8afc6ee0
RBP: 000000000000007f R08: ffffffff8e4a8e2f R09: 1ffffffff1c951c5
R10: dffffc0000000000 R11: fffffbfff1c951c6 R12: ffff88807cab5120
R13: ffffea0001d6e2b4 R14: 1ffff1100f956a24 R15: 1ffff1100f956a31
FS:  00007f1699e3d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbf4a163000 CR3: 0000000028bea000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 txUnlock+0x427/0xcb0 fs/jfs/jfs_txnmgr.c:948
 txCommit+0x4dbd/0x5250 fs/jfs/jfs_txnmgr.c:1336
 duplicateIXtree+0x293/0x480 fs/jfs/jfs_imap.c:3019
 diNewIAG fs/jfs/jfs_imap.c:2597 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0x1795/0x1de0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d5/0x1660 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x950 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x191/0xa30 fs/jfs/namei.c:225
 vfs_mkdir+0x296/0x440 fs/namei.c:4121
 do_mkdirat+0x1d4/0x440 fs/namei.c:4144
 __do_sys_mkdirat fs/namei.c:4159 [inline]
 __se_sys_mkdirat fs/namei.c:4157 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4157
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1698f8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1699e3d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f16991e5fa0 RCX: 00007f1698f8f749
RDX: 0000000000000000 RSI: 0000200000000840 RDI: ffffffffffffff9c
RBP: 00007f1699013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f16991e6038 R14: 00007f16991e5fa0 R15: 00007fff83350ba8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_get include/linux/mm.h:1458 [inline]
RIP: 0010:get_page include/linux/mm.h:1464 [inline]
RIP: 0010:put_metapage+0x253/0x340 fs/jfs/jfs_metapage.c:750
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 07 1a dd fe e9 25 ff ff ff e8 5d ab 85 fe 48 8b 3c 24 48 c7 c6 00 f8 e3 8a e8 0d 80 c5 fe <0f> 0b f3 0f 1e fa 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff
RSP: 0018:ffffc90003587560 EFLAGS: 00010246
RAX: 803f9364bb11a000 RBX: ffff88807cab50f8 RCX: 803f9364bb11a000
RDX: 0000000000000000 RSI: ffffffff8afc6f20 RDI: ffffffff8afc6ee0
RBP: 000000000000007f R08: ffffffff8e4a8e2f R09: 1ffffffff1c951c5
R10: dffffc0000000000 R11: fffffbfff1c951c6 R12: ffff88807cab5120
R13: ffffea0001d6e2b4 R14: 1ffff1100f956a24 R15: 1ffff1100f956a31
FS:  00007f1699e3d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbf4a163000 CR3: 0000000028bea000 CR4: 00000000003506f0