BUG: Bad page state in process syz.0.299  pfn:1afeee
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000000 pfn:0x1afeee
flags: 0x57ff0000002090c(referenced|uptodate|active|owner_2|swapbacked|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff0000002090c 0000000000000000 dead000000000122 0000000000000000
raw: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 6533, tgid 6533 (syz.0.299), ts 81240765960, free_ts 78735266197
 post_alloc_hook+0x231/0x280
 get_page_from_freelist+0x2503/0x25a0
 __alloc_frozen_pages_noprof+0x18d/0x380
 alloc_pages_mpol+0x22b/0x390
 vma_alloc_folio_noprof+0xea/0x210
 do_pte_missing+0x172b/0x39a0
 handle_mm_fault+0x1b11/0x3270
 do_user_addr_fault+0xa4d/0x1340
 exc_page_fault+0x6a/0xc0
 asm_exc_page_fault+0x26/0x30
page last free pid 6407 tgid 6407 stack trace:
 free_unref_folios+0xf29/0x1740
 folios_put_refs+0x795/0x8d0
 shmem_undo_range+0x4e6/0x15d0
 shmem_evict_inode+0x280/0xa70
 evict+0x624/0xb50
 __dentry_kill+0x19f/0x5d0
 finish_dput+0xca/0x490
 __fput+0x670/0xa40
 task_work_run+0x1d9/0x270
 do_exit+0x73a/0x2460
 do_group_exit+0x22d/0x2f0
 get_signal+0x121b/0x12c0
 arch_do_signal_or_restart+0xbb/0x810
 irqentry_exit+0x196/0x700
 asm_exc_page_fault+0x26/0x30
Modules linked in:
CPU: 1 UID: 0 PID: 6534 Comm: syz.0.299 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 bad_page+0x17f/0x1c0
 free_unref_folios+0x1070/0x1740
 folios_put_refs+0x795/0x8d0
 free_pages_and_swap_cache+0x525/0x590
 tlb_flush_mmu+0x6d3/0xa30
 unmap_page_range+0x3c70/0x48f0
 unmap_vmas+0x462/0x680
 exit_mmap+0x292/0xa20
 __mmput+0x118/0x420
 exit_mm+0x160/0x210
 do_exit+0x6cd/0x2460
 do_group_exit+0x22d/0x2f0
 get_signal+0x121b/0x12c0
 arch_do_signal_or_restart+0xbb/0x810
 exit_to_user_mode_loop+0xa3/0x5e0
 do_syscall_64+0x357/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f60f299e019
Code: Unable to access opcode bytes at 0x7f60f299dfef.
RSP: 002b:00007f60f38770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f60f2c25fa8 RCX: 00007f60f299e019
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f60f2c25fa8
RBP: 00007f60f2c25fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f60f2c26038 R14: 00007ffdff4d49b0 R15: 00007ffdff4d4a98
 </TASK>
