BUG: Bad page state in process syz.6.968 pfn:35158
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035159e00 pfn:0x35158
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888035159e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988432360, free_ts 144457061520
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2aaad
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2aaad
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988428068, free_ts 144457066734
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2aaac
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802aaade00 pfn:0x2aaac
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88802aaade00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988423782, free_ts 144457066734
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:296df
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x296df
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988419509, free_ts 144457087064
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:296de
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880296dfe00 pfn:0x296de
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff8880296dfe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988414879, free_ts 144457087064
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:458ff
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x458ff
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988410331, free_ts 144457091194
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:458fe
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880458ffe00 pfn:0x458fe
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff8880458ffe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988406150, free_ts 144457091194
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:28efd
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x28efd
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988401555, free_ts 144457095500
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:28efc
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028efde00 pfn:0x28efc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888028efde00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988397299, free_ts 144457095500
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:24d95
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x24d95
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988393143, free_ts 144457099224
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:24d94
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888024d95e00 pfn:0x24d94
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888024d95e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988388635, free_ts 144457099224
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:28f83
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x28f83
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988383893, free_ts 144457104002
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:28f82
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028f83e00 pfn:0x28f82
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888028f83e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988379589, free_ts 144457104002
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:24c23
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x24c23
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988375193, free_ts 144457131613
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:24c22
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888024c23e00 pfn:0x24c22
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888024c23e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988370385, free_ts 144457131613
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:267e9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x267e9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988365954, free_ts 144457136573
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:267e8
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880267e9e00 pfn:0x267e8
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff8880267e9e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988361632, free_ts 144457136573
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2a077
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2a077
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988356473, free_ts 144457140561
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2a076
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a077e00 pfn:0x2a076
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88802a077e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988351615, free_ts 144457140561
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:4ca3d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4ca3d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988347435, free_ts 144457144767
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:4ca3c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804ca3de00 pfn:0x4ca3c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88804ca3de00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988342689, free_ts 144457144767
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:3206f
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x3206f
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988338043, free_ts 144457149560
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:79 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:79
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:3206e
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803206fe00 pfn:0x3206e
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88803206fe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988333481, free_ts 144457149560
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:79 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:79
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:31f2d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x31f2d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988328853, free_ts 144457173669
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:31f2c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031f2de00 pfn:0x31f2c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888031f2de00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988324048, free_ts 144457173669
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:3152d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x3152d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988319333, free_ts 144457178539
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:3152c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803152de00 pfn:0x3152c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88803152de00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988314930, free_ts 144457178539
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:4d7b5
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x4d7b5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988309276, free_ts 144457182739
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:4d7b4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d7b5e00 pfn:0x4d7b4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88804d7b5e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988299078, free_ts 144457182739
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:23377
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x23377
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988294534, free_ts 144457186940
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:23376
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023377e00 pfn:0x23376
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888023377e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988290324, free_ts 144457186940
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10040 tgid 10040 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
mt_alloc_one lib/maple_tree.c:162 [inline]
mas_alloc_nodes+0x176/0x860 lib/maple_tree.c:1241
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1321
mas_preallocate+0x53b/0xcd0 lib/maple_tree.c:5546
vma_iter_prealloc mm/vma.h:432 [inline]
commit_merge+0x61d/0xec0 mm/vma.c:601
vma_expand+0x3ee/0x990 mm/vma.c:1024
vma_merge_new_range+0x37d/0xd20 mm/vma.c:963
mmap_region+0x499/0x2a50 mm/mmap.c:1421
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:588
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:561e3
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x561e3
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988286162, free_ts 145878670819
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10094 tgid 10094 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
mm_free_pgd kernel/fork.c:803 [inline]
__mmdrop+0xd5/0x460 kernel/fork.c:919
mmdrop include/linux/sched/mm.h:55 [inline]
__mmput+0x3c8/0x480 kernel/fork.c:1358
mmput+0x62/0x70 kernel/fork.c:1369
exec_mmap fs/exec.c:1014 [inline]
begin_new_exec+0x13b9/0x3390 fs/exec.c:1280
load_elf_binary+0x7ee/0x4e20 fs/binfmt_elf.c:996
search_binary_handler fs/exec.c:1752 [inline]
exec_binprm fs/exec.c:1794 [inline]
bprm_execve fs/exec.c:1845 [inline]
bprm_execve+0x703/0x1960 fs/exec.c:1821
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:1952
do_execve fs/exec.c:2026 [inline]
__do_sys_execve fs/exec.c:2102 [inline]
__se_sys_execve fs/exec.c:2097 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2097
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:561e2
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012006880 pfn:0x561e2
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888012006880 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988281581, free_ts 145878670819
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10094 tgid 10094 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
mm_free_pgd kernel/fork.c:803 [inline]
__mmdrop+0xd5/0x460 kernel/fork.c:919
mmdrop include/linux/sched/mm.h:55 [inline]
__mmput+0x3c8/0x480 kernel/fork.c:1358
mmput+0x62/0x70 kernel/fork.c:1369
exec_mmap fs/exec.c:1014 [inline]
begin_new_exec+0x13b9/0x3390 fs/exec.c:1280
load_elf_binary+0x7ee/0x4e20 fs/binfmt_elf.c:996
search_binary_handler fs/exec.c:1752 [inline]
exec_binprm fs/exec.c:1794 [inline]
bprm_execve fs/exec.c:1845 [inline]
bprm_execve+0x703/0x1960 fs/exec.c:1821
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:1952
do_execve fs/exec.c:2026 [inline]
__do_sys_execve fs/exec.c:2102 [inline]
__se_sys_execve fs/exec.c:2097 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2097
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:35014
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035015e00 pfn:0x35014
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888035015e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988277041, free_ts 145690334397
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 34 tgid 34 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:46fb4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888046fb7c00 pfn:0x46fb4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888046fb7c00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988271868, free_ts 145560269001
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:58086
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888058087e00 pfn:0x58086
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888058087e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988267134, free_ts 145296239137
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5361 tgid 5361 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5df53
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5df53
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988262861, free_ts 145529813555
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:32599
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x32599
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988258438, free_ts 145399973963
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:42b5a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888042b5be00 pfn:0x42b5a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888042b5be00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988253986, free_ts 142930763381
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 9990 tgid 9990 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
vfree+0x17a/0x890 mm/vmalloc.c:3361
kvm_arch_free_memslot+0x115/0x1d0 arch/x86/kvm/x86.c:12909
kvm_free_memslot virt/kvm/kvm_main.c:987 [inline]
kvm_free_memslots.part.0+0x12a/0x1f0 virt/kvm/kvm_main.c:1008
kvm_free_memslots virt/kvm/kvm_main.c:1354 [inline]
kvm_destroy_vm virt/kvm/kvm_main.c:1354 [inline]
kvm_put_kvm+0x8b5/0xb40 virt/kvm/kvm_main.c:1386
kvm_vm_release+0x3c/0x50 virt/kvm/kvm_main.c:1409
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5f239
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x5f239
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988249344, free_ts 145690319339
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 34 tgid 34 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5e0c6
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e0c6
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988244484, free_ts 145560169105
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5e0ca
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e0ca
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988240024, free_ts 145507168641
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10061 tgid 10060 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
put_page+0x21e/0x280 include/linux/mm.h:1550
anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128
pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
free_pipe_info+0x1fa/0x3b0 fs/pipe.c:853
put_pipe_info fs/pipe.c:719 [inline]
pipe_release+0x2bf/0x320 fs/pipe.c:742
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:239
get_signal+0x1ca/0x2770 kernel/signal.c:2690
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:48f28
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888048f29e00 pfn:0x48f28
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888048f29e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988235773, free_ts 145370789857
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5941 tgid 5941 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
ptlock_alloc+0x1f/0x70 mm/memory.c:6907
ptlock_init include/linux/mm.h:2958 [inline]
pagetable_pte_ctor include/linux/mm.h:2985 [inline]
__pte_alloc_one_noprof include/asm-generic/pgalloc.h:73 [inline]
pte_alloc_one+0x74/0x360 arch/x86/mm/pgtable.c:33
__pte_alloc+0x6e/0x390 mm/memory.c:448
copy_pte_range mm/memory.c:1108 [inline]
copy_pmd_range mm/memory.c:1255 [inline]
copy_pud_range mm/memory.c:1292 [inline]
copy_p4d_range mm/memory.c:1316 [inline]
copy_page_range+0x16ce/0x4f40 mm/memory.c:1414
dup_mmap kernel/fork.c:750 [inline]
dup_mm kernel/fork.c:1674 [inline]
copy_mm kernel/fork.c:1723 [inline]
copy_process+0x82f9/0x8cb0 kernel/fork.c:2372
kernel_clone+0xfd/0x960 kernel/fork.c:2784
__do_sys_clone+0xba/0x100 kernel/fork.c:2927
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:559c0
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880559c0f00 pfn:0x559c0
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff8880559c0f00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988231324, free_ts 144459707755
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2d4c9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d4c9f00 pfn:0x2d4c9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88802d4c9f00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988227040, free_ts 144459713031
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:22549
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888022549aa8 pfn:0x22549
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888022549aa8 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988222840, free_ts 144459717896
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:27c29
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027c29f00 pfn:0x27c29
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888027c29f00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988218547, free_ts 144459723275
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:21820
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888021820c98 pfn:0x21820
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888021820c98 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988213633, free_ts 144459728743
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:48321
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888048321e88 pfn:0x48321
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888048321e88 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988209044, free_ts 144459739898
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:31300
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031300c30 pfn:0x31300
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888031300c30 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988204524, free_ts 144459745485
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5af5d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805af5de88 pfn:0x5af5d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88805af5de88 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988200033, free_ts 144459750848
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2e1a6
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802e1a6e88 pfn:0x2e1a6
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88802e1a6e88 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988195348, free_ts 144459756201
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:5d92b
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805d92bca8 pfn:0x5d92b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff88805d92bca8 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988190609, free_ts 144459761528
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:29fc2
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029fc2a20 pfn:0x29fc2
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888029fc2a20 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988186084, free_ts 144459767250
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:27c13
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027c13e88 pfn:0x27c13
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888027c13e88 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988181224, free_ts 144459772449
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:23003
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023003948 pfn:0x23003
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888023003948 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988176670, free_ts 144459777765
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:4fc43
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4fc43
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988171758, free_ts 144459782737
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 10042 tgid 10041 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:2917f
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2917f
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988166972, free_ts 145936375817
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 8382 tgid 8382 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
selinux_genfs_get_sid security/selinux/hooks.c:1348 [inline]
inode_doinit_with_dentry+0xac4/0x12c0 security/selinux/hooks.c:1546
selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6331
security_d_instantiate+0x142/0x1a0 security/security.c:4063
d_splice_alias+0x94/0xdf0 fs/dcache.c:2989
kernfs_iop_lookup+0x286/0x330 fs/kernfs/dir.c:1229
__lookup_slow+0x24f/0x460 fs/namei.c:1732
lookup_slow fs/namei.c:1749 [inline]
walk_component+0x350/0x5b0 fs/namei.c:2053
lookup_last fs/namei.c:2556 [inline]
path_lookupat+0x17f/0x770 fs/namei.c:2580
filename_lookup+0x1e5/0x5b0 fs/namei.c:2609
vfs_statx+0x11e/0x1e0 fs/stat.c:312
vfs_fstatat+0x9f/0x160 fs/stat.c:341
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:40180
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040186600 pfn:0x40180
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888040186600 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988162209, free_ts 145939979216
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6226 tgid 6226 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
do_softirq kernel/softirq.c:455 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:442
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
spin_unlock_bh include/linux/spinlock.h:396 [inline]
hash_ipportip4_gc+0x240/0x460 net/netfilter/ipset/ip_set_hash_gen.h:581
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68
BUG: Bad page state in process syz.6.968 pfn:40447
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040447f00 pfn:0x40447
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888033265000 0000000000000000
raw: ffff888040447f00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 10099, tgid 10095 (syz.6.968), ts 145988157490, free_ts 145939986919
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6226 tgid 6226 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
do_softirq kernel/softirq.c:455 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:442
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
spin_unlock_bh include/linux/spinlock.h:396 [inline]
hash_ipportip4_gc+0x240/0x460 net/netfilter/ipset/ip_set_hash_gen.h:581
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 3 UID: 0 PID: 10099 Comm: syz.6.968 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3c36f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3c37ce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f3c37136058 RCX: 00007f3c36f7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007f3c36ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3c37136058 R15: 00007ffe02d56c68