BUG: Bad page state in process syz.2.828  pfn:14fea6
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000000 pfn:0x14fea6
flags: 0x17ff0000002090c(referenced|uptodate|active|owner_2|swapbacked|node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff0000002090c 0000000000000000 dead000000000122 0000000000000000
raw: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 7662, tgid 7662 (syz.2.828), ts 107024604655, free_ts 107017832418
 post_alloc_hook+0x231/0x280
 get_page_from_freelist+0x2503/0x25a0
 __alloc_frozen_pages_noprof+0x18d/0x380
 alloc_pages_mpol+0x22b/0x390
 vma_alloc_folio_noprof+0xea/0x210
 do_pte_missing+0x172b/0x39a0
 handle_mm_fault+0x1b11/0x3270
 do_user_addr_fault+0xa4d/0x1340
 exc_page_fault+0x6a/0xc0
 asm_exc_page_fault+0x26/0x30
page last free pid 7659 tgid 7658 stack trace:
 free_unref_folios+0xf29/0x1740
 folios_put_refs+0x795/0x8d0
 shmem_undo_range+0x4e6/0x15d0
 shmem_evict_inode+0x280/0xa70
 evict+0x624/0xb50
 __dentry_kill+0x19f/0x5d0
 finish_dput+0xca/0x490
 __fput+0x670/0xa40
 task_work_run+0x1d9/0x270
 exit_to_user_mode_loop+0x18d/0x5e0
 do_syscall_64+0x357/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 7662 Comm: syz.2.828 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 bad_page+0x17f/0x1c0
 free_unref_folios+0x1070/0x1740
 folios_put_refs+0x795/0x8d0
 free_pages_and_swap_cache+0x525/0x590
 tlb_flush_mmu+0x6d3/0xa30
 unmap_page_range+0x3c70/0x48f0
 unmap_vmas+0x462/0x680
 exit_mmap+0x292/0xa20
 __mmput+0x118/0x420
 exit_mm+0x160/0x210
 do_exit+0x6cd/0x2460
 do_group_exit+0x22d/0x2f0
 __x64_sys_exit_group+0x3f/0x40
 x64_sys_call+0x221a/0x2240
 do_syscall_64+0x170/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f234439e019
Code: Unable to access opcode bytes at 0x7f234439dfef.
RSP: 002b:00007ffebc87e148 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f234439e019
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffebc87e1ac R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000105
R13: 00000000000927c0 R14: 000000000001a1d2 R15: 00007ffebc87e200
 </TASK>
