free_pages_and_swap_cache+0x242/0x480 mm/swap_state.c:354
 __tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:137
 tlb_batch_pages_flush mm/mmu_gather.c:150 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
 tlb_flush_mmu mm/mmu_gather.c:405 [inline]
 tlb_finish_mmu+0x1b0/0x810 mm/mmu_gather.c:530
 vms_clear_ptes+0x55c/0x790 mm/vma.c:1278
 vms_clean_up_area mm/vma.c:1290 [inline]
 __mmap_setup mm/vma.c:2442 [inline]
 __mmap_region+0x5cd/0x2820 mm/vma.c:2734
 mmap_region+0x180/0x3e0 mm/vma.c:2830
 do_mmap+0xc63/0x12f0 mm/mmap.c:558
 vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
 ksys_mmap_pgoff+0x7d/0x5b0 mm/mmap.c:604
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at mm/filemap.c:155!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5918 Comm: syz.1.5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:filemap_unaccount_folio+0x728/0xb30 mm/filemap.c:155
Code: 00 48 8b b5 a0 01 00 00 48 89 df e8 b2 7d 03 00 e9 3c fd ff ff e8 b8 47 c8 ff 48 c7 c6 40 f6 9c 8b 48 89 df e8 49 9a 12 00 90 <0f> 0b e8 a1 47 c8 ff 48 c7 c6 e0 f0 9c 8b 48 89 df e8 32 9a 12 00
RSP: 0018:ffffc9000af57458 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffea0001ca5f00 RCX: ffffc9000af5733c
RDX: ffff88807d27dac0 RSI: ffffffff8250bb68 RDI: ffff88807d27df44
RBP: ffffea0001ca5f30 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88807d6feb20
R13: ffffea0001ca5f08 R14: 0000000000000001 R15: ffffea0001ca5f18
FS:  0000000000000000(0000) GS:ffff8881246c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa982000020 CR3: 000000007d932000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __filemap_remove_folio+0xae/0x660 mm/filemap.c:227
 filemap_remove_folio+0xfc/0x270 mm/filemap.c:257
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x3ae/0x1570 mm/shmem.c:1146
 shmem_truncate_range mm/shmem.c:1278 [inline]
 shmem_evict_inode+0x39e/0xbd0 mm/shmem.c:1408
 evict+0x3c2/0xad0 fs/inode.c:837
 iput_final fs/inode.c:1957 [inline]
 iput.part.0+0x605/0xf50 fs/inode.c:2006
 iput+0x35/0x40 fs/inode.c:1972
 dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
 __dentry_kill+0x1d0/0x600 fs/dcache.c:670
 finish_dput+0x76/0x480 fs/dcache.c:879
 dput.part.0+0x456/0x570 fs/dcache.c:928
 dput+0x1f/0x30 fs/dcache.c:920
 __fput+0x519/0xb40 fs/file_table.c:477
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x829/0x2a30 kernel/exit.c:971
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 __do_sys_exit_group kernel/exit.c:1123 [inline]
 __se_sys_exit_group kernel/exit.c:1121 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
 x64_sys_call+0x14fd/0x1510 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9260b9bf79
Code: Unable to access opcode bytes at 0x7f9260b9bf4f.
RSP: 002b:00007ffd377839b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9260b9bf79
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd37783a1c R08: 0000000000000000 R09: 00000000000927c0
R10: 00007f9260e16128 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000001757c R15: 00007ffd37783a70
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:filemap_unaccount_folio+0x728/0xb30 mm/filemap.c:155
Code: 00 48 8b b5 a0 01 00 00 48 89 df e8 b2 7d 03 00 e9 3c fd ff ff e8 b8 47 c8 ff 48 c7 c6 40 f6 9c 8b 48 89 df e8 49 9a 12 00 90 <0f> 0b e8 a1 47 c8 ff 48 c7 c6 e0 f0 9c 8b 48 89 df e8 32 9a 12 00
RSP: 0018:ffffc9000af57458 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffea0001ca5f00 RCX: ffffc9000af5733c
RDX: ffff88807d27dac0 RSI: ffffffff8250bb68 RDI: ffff88807d27df44
RBP: ffffea0001ca5f30 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88807d6feb20
R13: ffffea0001ca5f08 R14: 0000000000000001 R15: ffffea0001ca5f18
FS:  0000000000000000(0000) GS:ffff8881246c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa982000020 CR3: 000000007d932000 CR4: 00000000003526f0