[syzbot] BUG: Bad rss-counter state (6)

[syzbot] BUG: Bad rss-counter state (6)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    e84d960149e7 Merge tag 'for-6.19-rc5-tag' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=145c3b9a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1859476832863c41
dashboard link: https://syzkaller.appspot.com/bug?extid=5981772e2b70777a3b01
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-e84d9601.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da873e352c9a/vmlinux-e84d9601.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ee84236e98b6/bzImage-e84d9601.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5981772e2b70777a3b01@syzkaller.appspotmail.com

BUG: Bad rss-counter state mm:ffff88801b484980 type:MM_FILEPAGES val:1 Comm:syz-executor Pid:32615
BUG: Bad rss-counter state mm:ffff88801b484980 type:MM_SWAPENTS val:148 Comm:syz-executor Pid:32615


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] BUG: Bad rss-counter state (6)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    71c3e5409eef Merge remote-tracking branch 'will/for-next/p..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=137d5f25580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c7205f05c11fb4dd
dashboard link: https://syzkaller.appspot.com/bug?extid=5981772e2b70777a3b01
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=177d5f25580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/20ff6159ce99/disk-71c3e540.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d6172672705/vmlinux-71c3e540.xz
kernel image: https://storage.googleapis.com/syzbot-assets/923d5e083e1b/Image-71c3e540.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5981772e2b70777a3b01@syzkaller.appspotmail.com

BUG: Bad rss-counter state mm:00000000950a6f7b type:MM_ANONPAGES val:2 Comm:syz-executor Pid:4828
BUG: non-zero pgtables_bytes on freeing mm: 4096


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.