__do_sys_munmap mm/mmap.c:1077 [inline] __se_sys_munmap mm/mmap.c:1074 [inline] __x64_sys_munmap+0x60/0x70 mm/mmap.c:1074 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ------------[ cut here ]------------ kernel BUG at mm/filemap.c:1531! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 11096 Comm: syz.2.1233 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:folio_end_read+0x22e/0x230 mm/filemap.c:1531 Code: 54 c7 ff 48 89 df 48 c7 c6 c0 84 74 8b e8 1a 93 2d ff 90 0f 0b e8 d2 54 c7 ff 48 89 df 48 c7 c6 20 7d 74 8b e8 03 93 2d ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa RSP: 0018:ffffc9000cec6ac8 EFLAGS: 00010246 RAX: d6a5eef1937f7800 RBX: ffffea0002d10780 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff8d78f926 RDI: 00000000ffffffff RBP: 0000000000000001 R08: ffffffff8f7deb77 R09: 1ffffffff1efbd6e R10: dffffc0000000000 R11: fffffbfff1efbd6f R12: 1ffffd40005a20f1 R13: 1ffffd40005a20f0 R14: ffffea0002d10788 R15: 0000000000000008 FS: 00007fa1739e86c0(0000) GS:ffff888125fb9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561581847660 CR3: 0000000065348000 CR4: 00000000003526f0 Call Trace: iomap_readahead_iter fs/iomap/buffered-io.c:590 [inline] iomap_readahead+0x3f5/0xbd0 fs/iomap/buffered-io.c:636 iomap_bio_readahead include/linux/iomap.h:609 [inline] xfs_vm_readahead+0x9f/0xe0 fs/xfs/xfs_aops.c:753 read_pages+0x17a/0x580 mm/readahead.c:163 page_cache_ra_order+0x904/0xe80 mm/readahead.c:518 do_sync_mmap_readahead+0x66a/0x870 mm/filemap.c:3400 filemap_fault+0x6ac/0x12b0 mm/filemap.c:3549 __do_fault+0x138/0x390 mm/memory.c:5318 do_read_fault mm/memory.c:5753 [inline] do_fault mm/memory.c:5887 [inline] do_pte_missing+0x2209/0x3380 mm/memory.c:4399 handle_pte_fault mm/memory.c:6271 [inline] __handle_mm_fault mm/memory.c:6409 [inline] handle_mm_fault+0x1b48/0x32c0 mm/memory.c:6578 do_user_addr_fault+0x764/0x1380 arch/x86/mm/fault.c:1387 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0010:fault_in_readable+0x8e/0x130 mm/gup.c:2161 Code: a9 00 00 00 0f 01 cb 0f ae e8 4d 85 f6 40 0f 95 c5 4c 89 ff 4c 89 f6 e8 e0 f2 b5 ff 4d 39 f7 0f 97 c0 40 84 c5 74 43 4d 89 f5 <41> 8a 45 00 88 44 24 07 49 81 e5 00 f0 ff ff 4d 8d a5 00 10 00 00 RSP: 0018:ffffc9000cec7728 EFLAGS: 00050287 RAX: ffffffff820bbf6c RBX: 000000000000abee RCX: 0000000000080000 RDX: ffffc9000c11a000 RSI: 0000000000000294 RDI: 0000000000000295 RBP: dffffc0000000001 R08: ffff888031595b80 R09: 0000000000000002 R10: 0000000000000001 R11: 0000000000000002 R12: 0000200000003000 R13: 0000200000003000 R14: 0000200000000080 R15: 000020000000ac6e fault_in_iov_iter_readable+0x124/0x2f0 lib/iov_iter.c:120 iomap_write_iter fs/iomap/buffered-io.c:1102 [inline] iomap_file_buffered_write+0x41e/0x9c0 fs/iomap/buffered-io.c:1188 xfs_file_buffered_write+0x209/0x8a0 fs/xfs/xfs_file.c:977 do_iter_readv_writev+0x623/0x8c0 fs/read_write.c:-1 vfs_writev+0x31a/0x960 fs/read_write.c:1057 do_pwritev fs/read_write.c:1153 [inline] __do_sys_pwritev2 fs/read_write.c:1211 [inline] __se_sys_pwritev2+0x179/0x290 fs/read_write.c:1202 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa172b8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa1739e8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007fa172de5fa0 RCX: 00007fa172b8f749 RDX: 000000000000001f RSI: 0000200000000100 RDI: 000000000000000b RBP: 00007fa172c13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000005412 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa172de6038 R14: 00007fa172de5fa0 R15: 00007ffd6a216128 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:folio_end_read+0x22e/0x230 mm/filemap.c:1531 Code: 54 c7 ff 48 89 df 48 c7 c6 c0 84 74 8b e8 1a 93 2d ff 90 0f 0b e8 d2 54 c7 ff 48 89 df 48 c7 c6 20 7d 74 8b e8 03 93 2d ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa RSP: 0018:ffffc9000cec6ac8 EFLAGS: 00010246 RAX: d6a5eef1937f7800 RBX: ffffea0002d10780 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff8d78f926 RDI: 00000000ffffffff RBP: 0000000000000001 R08: ffffffff8f7deb77 R09: 1ffffffff1efbd6e R10: dffffc0000000000 R11: fffffbfff1efbd6f R12: 1ffffd40005a20f1 R13: 1ffffd40005a20f0 R14: ffffea0002d10788 R15: 0000000000000008 FS: 00007fa1739e86c0(0000) GS:ffff888125eb9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb38b18c000 CR3: 0000000065348000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: a9 00 00 00 0f test $0xf000000,%eax 5: 01 cb add %ecx,%ebx 7: 0f ae e8 lfence a: 4d 85 f6 test %r14,%r14 d: 40 0f 95 c5 setne %bpl 11: 4c 89 ff mov %r15,%rdi 14: 4c 89 f6 mov %r14,%rsi 17: e8 e0 f2 b5 ff call 0xffb5f2fc 1c: 4d 39 f7 cmp %r14,%r15 1f: 0f 97 c0 seta %al 22: 40 84 c5 test %al,%bpl 25: 74 43 je 0x6a 27: 4d 89 f5 mov %r14,%r13 * 2a: 41 8a 45 00 mov 0x0(%r13),%al <-- trapping instruction 2e: 88 44 24 07 mov %al,0x7(%rsp) 32: 49 81 e5 00 f0 ff ff and $0xfffffffffffff000,%r13 39: 4d 8d a5 00 10 00 00 lea 0x1000(%r13),%r12