syzbot

 sign-in | mailing list | source | docs
🐞 Open [1517]
≡ Subsystems
🐞 Fixed [6644]
🐞 Invalid [17027]
⬇ Missing Backports [214]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

BUG: Bad page state in skb_pp_cow_data

Status: upstream: reported C repro on 2024/12/09 10:16
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+ff145014d6b0ce64a173@syzkaller.appspotmail.com
First crash: 309d, last: 1d09h
Cause bisection: introduced by (bisect log) :
commit e6d5dbdd20aa6a86974af51deb9414cd2e7794cb
Author: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Mon Feb 12 09:50:56 2024 +0000

  xdp: add multi-buff support for xdp running in generic mode

Crash: BUG: Bad page state in skb_cow_data_for_xdp (log)
Repro: C syz .config
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH bpf 1/2] xdp: update xdp_rxq_info's mem type in XDP generic hook 4 (4) 2025/10/07 20:18
[PATCH net v2] xdp: update mem type when page pool is used for generic XDP 10 (10) 2025/10/02 18:32
[PATCH net] xdp: use multi-buff only if receive queue supports page pool 10 (10) 2025/09/30 17:41
[syzbot] [net?] BUG: Bad page state in skb_pp_cow_data 2 (3) 2024/12/11 13:41
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/10/02 09:50 14m retest repro upstream report log
2025/10/02 09:56 14m retest repro upstream report log
2025/10/02 09:50 47m retest repro upstream report log
2025/10/02 09:56 14m retest repro upstream report log
2025/09/09 23:47 16m retest repro net report log
2025/08/03 01:44 46m retest repro upstream report log
2025/08/03 01:44 39m retest repro upstream report log
2025/08/03 01:44 23m retest repro upstream report log
2025/07/19 21:26 11m retest repro upstream report log
2025/07/05 20:03 14m retest repro upstream report log

Sample crash report:
BUG: Bad page state in process syz-executor285  pfn:2d302
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d302
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999485029, free_ts 54592867285
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Not tainted 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:2d301
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2d301
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999478821, free_ts 55944947211
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5810 tgid 5810 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:2d300
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d304000 pfn:0x2d300
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: ffff88802d304000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999472559, free_ts 55944400344
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5810 tgid 5810 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:72d3b
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d3b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999466297, free_ts 54575113729
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:72d3a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d3a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999460106, free_ts 54575122306
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:72d39
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d39
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999453972, free_ts 54575963863
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:72d38
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d38
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999447572, free_ts 54575218247
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:76907
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76907
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999441200, free_ts 54582364655
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:76906
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76906
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999421067, free_ts 54582851254
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:76905
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76905
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999414838, free_ts 54582871367
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>
BUG: Bad page state in process syz-executor285  pfn:76904
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76904
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999408239, free_ts 54582895841
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
 alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
 __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
 page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
 page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
 page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
 skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
 netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
 netif_receive_generic_xdp net/core/dev.c:5080 [inline]
 do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
page last free pid 5807 tgid 5807 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
 __folio_put+0x2c7/0x440 mm/swap.c:112
 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
 pipe_update_tail fs/pipe.c:224 [inline]
 pipe_read+0x6ed/0x13e0 fs/pipe.c:344
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x991/0xb70 fs/read_write.c:565
 ksys_read+0x18f/0x2b0 fs/read_write.c:708
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G    B              6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 bad_page+0x176/0x1d0 mm/page_alloc.c:501
 free_page_is_bad mm/page_alloc.c:923 [inline]
 free_pages_prepare mm/page_alloc.c:1119 [inline]
 free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
 bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
 bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
 ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
 bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
 bpf_prog_f476d5219b92964a+0x1e/0x20
 __bpf_prog_run include/linux/filter.h:701 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
 netif_receive_generic_xdp net/core/dev.c:5086 [inline]
 do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
 __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
 netif_receive_skb_internal net/core/dev.c:5871 [inline]
 netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
 tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xaeb/0xd30 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941abf7db0
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
 </TASK>

Crashes (49):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/08 10:06 upstream 7503345ac5f5 9ac0fdc6 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2024/12/08 09:29 upstream 7503345ac5f5 9ac0fdc6 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2024/12/08 08:51 upstream 7503345ac5f5 9ac0fdc6 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/09/18 09:38 upstream 8b789f2b7602 e2beed91 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/06/07 00:59 upstream c0c9379f235d 4826c28e .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 07:18 upstream 2f2d52945852 875573af .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 07:04 upstream 3ba7dfb8da62 875573af .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/08/26 22:13 net 007a5ffadc4f e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce BUG: Bad page state in skb_pp_cow_data
2025/10/11 23:02 upstream 0739473694c4 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2025/06/19 11:19 upstream fb4d33ab452e ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2025/06/10 21:51 upstream f09079bd04a9 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/04/28 14:46 upstream b4432656b36e c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 13:30 upstream 3ba7dfb8da62 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 10:48 upstream 327ecdbc0fda 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 08:12 upstream 3ba7dfb8da62 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 08:12 upstream 3ba7dfb8da62 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/01/27 05:45 upstream c2da8b3f914f 9fbd772e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/01/20 08:45 upstream 9528d418de4d f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: Bad page state in skb_pp_cow_data
2025/01/14 11:15 upstream c45323b7560e b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2025/01/14 11:12 upstream c45323b7560e b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2024/12/30 01:59 upstream 4099a71718b0 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: Bad page state in skb_pp_cow_data
2024/12/08 08:12 upstream 7503345ac5f5 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: Bad page state in skb_pp_cow_data
2025/08/25 22:19 upstream b6add54ba618 bf27483f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/08/21 08:47 upstream 41cd3fd15263 0b9605c8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/08/20 23:00 upstream 41cd3fd15263 bd178e57 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/06/21 19:34 upstream 3f75bfff44be d6cdfb8a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/06/21 10:47 upstream 11313e2f7812 d6cdfb8a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/06/21 10:46 upstream 11313e2f7812 d6cdfb8a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/06/19 10:54 upstream 74b4cc9b8780 ed3e87f7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/05/08 04:44 upstream d76bb1ebb558 dbf35fa1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:45 upstream 3ba7dfb8da62 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:43 upstream 2f2d52945852 875573af .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:43 upstream 2f2d52945852 875573af .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:43 upstream 2f2d52945852 875573af .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:43 upstream 2f2d52945852 875573af .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: Bad page state in skb_pp_cow_data
2025/02/27 12:38 upstream dd83757f6e68 6a8fcbc4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/02/26 17:02 upstream ac9c34d1e45a 6a8fcbc4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/02/26 10:51 upstream ac9c34d1e45a d34966d1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:49 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:48 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:47 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:47 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:46 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:46 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/03/25 06:46 upstream 2f2d52945852 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: Bad page state in skb_pp_cow_data
2025/10/12 15:43 linux-next 2b763d465239 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: Bad page state in skb_pp_cow_data
2025/03/25 12:51 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 245aece3750d 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 BUG: Bad page state in skb_pp_cow_data
2025/03/25 12:49 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 245aece3750d 875573af .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 BUG: Bad page state in skb_pp_cow_data
* Struck through repros no longer work on HEAD.