I may have reproduced the bug (see attached), though the symptoms are slightly different. Hopefully, it's just the one bug. David --- page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x5626ca804 pfn:0x7948 flags: 0x2000000000000000(zone=1) raw: 2000000000000000 ffffea000024d3c8 ffffea00001e5248 0000000000000000 raw: 00000005626ca804 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u)) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1444! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 UID: 0 PID: 303 Comm: md5sum Not tainted 6.12.0-rc2-ktest-00012-g57e4ac5316ef-dirty #8 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__iov_iter_get_pages_alloc+0x701/0x7e0 Code: 0f 0b 4d 85 f6 0f 85 f8 fc ff ff e9 21 fe ff ff 48 c7 c6 38 6b 40 82 e8 cd f4 aa ff 0f 0b 48 c7 c6 38 6b 40 82 e8 bf f4 aa ff <0f> 0b 4d 89 6a 18 49 89 52 08 4d 89 42 10 45 88 4a 20 e9 26 fb ff RSP: 0018:ffff88800804f5c0 EFLAGS: 00010286 RAX: 000000000000005c RBX: 0000000000001000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000027 RDI: 00000000ffffffff RBP: ffff88800804f648 R08: ffff88807f1d8fa8 R09: 00000000fffc0000 R10: ffff88807dbd9000 R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000001000 FS: 00007f0c42c29580(0000) GS:ffff88807d8c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560cff5bb000 CR3: 00000000046a0002 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die_body.cold+0x19/0x2b ? __die+0x2a/0x40 ? die+0x2f/0x50 ? do_trap+0xb8/0x100 ? do_error_trap+0x6c/0x90 ? __iov_iter_get_pages_alloc+0x701/0x7e0 ? exc_invalid_op+0x52/0x70 ? __iov_iter_get_pages_alloc+0x701/0x7e0 ? asm_exc_invalid_op+0x1b/0x20 ? __iov_iter_get_pages_alloc+0x701/0x7e0 ? radix_tree_node_alloc.constprop.0+0xab/0xf0 iov_iter_get_pages_alloc2+0x20/0x50 p9_get_mapped_pages.part.0+0x77/0x260 ? find_held_lock+0x31/0x90 ? p9_tag_alloc+0x1c8/0x2f0 p9_virtio_zc_request+0x339/0x6f0 ? debug_smp_processor_id+0x17/0x20 ? debug_smp_processor_id+0x17/0x20 ? rcu_is_watching+0x11/0x50 ? p9_client_prepare_req+0x15f/0x190 p9_client_zc_rpc.constprop.0+0xe6/0x330 p9_client_read_once+0x145/0x2b0 p9_client_read+0x59/0x80 v9fs_issue_read+0x3d/0xa0 netfs_read_to_pagecache+0x27b/0x580 netfs_readahead+0x197/0x2f0 read_pages+0x4a/0x300 page_cache_ra_unbounded+0x197/0x250 page_cache_ra_order+0x2f7/0x400 ? __this_cpu_preempt_check+0x13/0x20 ? lock_release+0x168/0x290 page_cache_async_ra+0x1be/0x220 filemap_get_pages+0x2f3/0x870 filemap_read+0xdc/0x470 ? __this_cpu_preempt_check+0x13/0x20 ? lock_acquire+0xcc/0x1c0 ? preempt_count_add+0x4e/0xc0 ? down_read_interruptible+0xb3/0x1b0 netfs_buffered_read_iter+0x5c/0x90 netfs_file_read_iter+0x29/0x40 v9fs_file_read_iter+0x1b/0x30 vfs_read+0x22b/0x330 ksys_read+0x62/0xe0 __x64_sys_read+0x19/0x20 x64_sys_call+0x1b70/0x1d20 do_syscall_64+0x47/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e
