BUG: Bad page state in process jfsCommit  pfn:7992f
page:ffffea0001e64bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x7992f
flags: 0xfff08000002047(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff08000002047 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff8880288d11f0 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 4950, tgid 4949 (syz.1.115), ts 378390135290, free_ts 373472785902
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5614
 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292
 filemap_alloc_folio+0xdb/0x460 mm/filemap.c:999
 do_read_cache_folio+0x1bb/0x760 mm/filemap.c:3591
 do_read_cache_page+0x32/0x220 mm/filemap.c:3669
 read_mapping_page include/linux/pagemap.h:791 [inline]
 __get_metapage+0x316/0xfa0 fs/jfs/jfs_metapage.c:620
 diRead+0x6f7/0xbb0 fs/jfs/jfs_imap.c:367
 jfs_iget+0x89/0x3c0 fs/jfs/inode.c:35
 jfs_fill_super+0x708/0xac0 fs/jfs/super.c:580
 mount_bdev+0x287/0x3c0 fs/super.c:1443
 legacy_get_tree+0xe6/0x180 fs/fs_context.c:632
 vfs_get_tree+0x88/0x270 fs/super.c:1573
 do_new_mount+0x24a/0xa40 fs/namespace.c:3069
 do_mount fs/namespace.c:3412 [inline]
 __do_sys_mount fs/namespace.c:3620 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3597
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3525
 release_pages+0x1f92/0x2200 mm/swap.c:1035
 __pagevec_release+0x6d/0xe0 mm/swap.c:1055
 pagevec_release include/linux/pagevec.h:71 [inline]
 folio_batch_release include/linux/pagevec.h:135 [inline]
 truncate_inode_pages_range+0x2f6/0xff0 mm/truncate.c:372
 kill_bdev block/bdev.c:76 [inline]
 blkdev_flush_mapping+0x12c/0x290 block/bdev.c:664
 blkdev_put_whole block/bdev.c:695 [inline]
 blkdev_put+0x47f/0x710 block/bdev.c:955
 blkdev_close+0x51/0x80 block/fops.c:514
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1ca/0x250 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
Modules linked in:
CPU: 1 PID: 107 Comm: jfsCommit Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 bad_page+0x14b/0x170 mm/page_alloc.c:699
 free_page_is_bad mm/page_alloc.c:1291 [inline]
 free_pages_prepare mm/page_alloc.c:1452 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x42a/0x9a0 mm/page_alloc.c:3384
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3479
 txUnlock+0x27e/0xcb0 fs/jfs/jfs_txnmgr.c:932
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x56c/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
page:ffffea0001e64bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1c pfn:0x7992f
flags: 0xfff08000002047(locked|referenced|uptodate|workingset|private|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff08000002047 dead000000000100 dead000000000122 0000000000000000
raw: 000000000000001c ffff8880288d11f0 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140c40(GFP_NOFS|__GFP_COMP|__GFP_HARDWALL), pid 4950, tgid 4949 (syz.1.115), ts 378390135290, free_ts 373472785902
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5614
 folio_alloc+0x1c/0x60 mm/mempolicy.c:2292
 filemap_alloc_folio+0xdb/0x460 mm/filemap.c:999
 do_read_cache_folio+0x1bb/0x760 mm/filemap.c:3591
 do_read_cache_page+0x32/0x220 mm/filemap.c:3669
 read_mapping_page include/linux/pagemap.h:791 [inline]
 __get_metapage+0x316/0xfa0 fs/jfs/jfs_metapage.c:620
 diRead+0x6f7/0xbb0 fs/jfs/jfs_imap.c:367
 jfs_iget+0x89/0x3c0 fs/jfs/inode.c:35
 jfs_fill_super+0x708/0xac0 fs/jfs/super.c:580
 mount_bdev+0x287/0x3c0 fs/super.c:1443
 legacy_get_tree+0xe6/0x180 fs/fs_context.c:632
 vfs_get_tree+0x88/0x270 fs/super.c:1573
 do_new_mount+0x24a/0xa40 fs/namespace.c:3069
 do_mount fs/namespace.c:3412 [inline]
 __do_sys_mount fs/namespace.c:3620 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3597
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3525
 release_pages+0x1f92/0x2200 mm/swap.c:1035
 __pagevec_release+0x6d/0xe0 mm/swap.c:1055
 pagevec_release include/linux/pagevec.h:71 [inline]
 folio_batch_release include/linux/pagevec.h:135 [inline]
 truncate_inode_pages_range+0x2f6/0xff0 mm/truncate.c:372
 kill_bdev block/bdev.c:76 [inline]
 blkdev_flush_mapping+0x12c/0x290 block/bdev.c:664
 blkdev_put_whole block/bdev.c:695 [inline]
 blkdev_put+0x47f/0x710 block/bdev.c:955
 blkdev_close+0x51/0x80 block/fops.c:514
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1ca/0x250 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1146!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 107 Comm: jfsCommit Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:folio_get include/linux/mm.h:1146 [inline]
RIP: 0010:get_page include/linux/mm.h:1152 [inline]
RIP: 0010:put_metapage+0x24f/0x340 fs/jfs/jfs_metapage.c:721
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 1b 26 e4 fe e9 25 ff ff ff e8 d1 09 94 fe 48 8b 3c 24 48 c7 c6 c0 28 c6 8a e8 a1 95 ce fe <0f> 0b 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff e8 8a 0d 94
RSP: 0018:ffffc90002d07ce0 EFLAGS: 00010246
RAX: c455578e63f6bb00 RBX: ffff8880288d11f0 RCX: c455578e63f6bb00
RDX: 0000000000000000 RSI: ffffffff8adefac0 RDI: ffffffff8adefa80
RBP: 000000000000007f R08: dffffc0000000000 R09: fffffbfff1c3ee26
R10: fffffbfff1c3ee26 R11: 1ffffffff1c3ee25 R12: ffff8880288d1218
R13: ffffea0001e64bf4 R14: 1ffff1100511a243 R15: 1ffff1100511a250
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f11a58fe000 CR3: 000000005b55c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 txUnlock+0x427/0xcb0 fs/jfs/jfs_txnmgr.c:947
 txLazyCommit fs/jfs/jfs_txnmgr.c:2682 [inline]
 jfs_lazycommit+0x56c/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_get include/linux/mm.h:1146 [inline]
RIP: 0010:get_page include/linux/mm.h:1152 [inline]
RIP: 0010:put_metapage+0x24f/0x340 fs/jfs/jfs_metapage.c:721
Code: 38 c1 0f 8c 32 ff ff ff 4c 89 ef e8 1b 26 e4 fe e9 25 ff ff ff e8 d1 09 94 fe 48 8b 3c 24 48 c7 c6 c0 28 c6 8a e8 a1 95 ce fe <0f> 0b 4c 8b 2c 24 4c 89 ee 48 81 e6 ff 0f 00 00 31 ff e8 8a 0d 94
RSP: 0018:ffffc90002d07ce0 EFLAGS: 00010246
RAX: c455578e63f6bb00 RBX: ffff8880288d11f0 RCX: c455578e63f6bb00
RDX: 0000000000000000 RSI: ffffffff8adefac0 RDI: ffffffff8adefa80
RBP: 000000000000007f R08: dffffc0000000000 R09: fffffbfff1c3ee26
R10: fffffbfff1c3ee26 R11: 1ffffffff1c3ee25 R12: ffff8880288d1218
R13: ffffea0001e64bf4 R14: 1ffff1100511a243 R15: 1ffff1100511a250
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f11a58fe000 CR3: 000000002fa44000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400