BUG: Bad page state in process syz.0.266 pfn:49c08
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888049c09e00 pfn:0x49c08
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888049c09e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102376567, free_ts 72661757006
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5977 tgid 5977 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path2_perm+0x369/0x710 security/tomoyo/file.c:923
tomoyo_path_rename+0x102/0x1b0 security/tomoyo/tomoyo.c:300
security_path_rename+0x18e/0x3c0 security/security.c:2022
do_renameat2+0x7a0/0xdd0 fs/namei.c:5157
__do_sys_rename fs/namei.c:5217 [inline]
__se_sys_rename fs/namei.c:5215 [inline]
__x64_sys_rename+0x7d/0xa0 fs/namei.c:5215
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2081d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x2081d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102367210, free_ts 72661766179
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5977 tgid 5977 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path2_perm+0x369/0x710 security/tomoyo/file.c:923
tomoyo_path_rename+0x102/0x1b0 security/tomoyo/tomoyo.c:300
security_path_rename+0x18e/0x3c0 security/security.c:2022
do_renameat2+0x7a0/0xdd0 fs/namei.c:5157
__do_sys_rename fs/namei.c:5217 [inline]
__se_sys_rename fs/namei.c:5215 [inline]
__x64_sys_rename+0x7d/0xa0 fs/namei.c:5215
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2081c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802081de00 pfn:0x2081c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802081de00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102357588, free_ts 72661766179
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5977 tgid 5977 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path2_perm+0x369/0x710 security/tomoyo/file.c:923
tomoyo_path_rename+0x102/0x1b0 security/tomoyo/tomoyo.c:300
security_path_rename+0x18e/0x3c0 security/security.c:2022
do_renameat2+0x7a0/0xdd0 fs/namei.c:5157
__do_sys_rename fs/namei.c:5217 [inline]
__se_sys_rename fs/namei.c:5215 [inline]
__x64_sys_rename+0x7d/0xa0 fs/namei.c:5215
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:405e7
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x700000002 pfn:0x405e7
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000700000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102347953, free_ts 72929314704
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5927 tgid 5927 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
vfree+0x17a/0x890 mm/vmalloc.c:3361
delayed_vfree_work+0x56/0x70 mm/vmalloc.c:3282
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:405e6
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880405e7e00 pfn:0x405e6
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880405e7e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102338217, free_ts 72927395041
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6881 tgid 6880 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
put_page+0x21e/0x280 include/linux/mm.h:1550
page_pool_return_page+0x400/0x520 net/core/page_pool.c:692
page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline]
page_pool_scrub net/core/page_pool.c:1040 [inline]
page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053
page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126
xdp_test_run_teardown net/bpf/test_run.c:218 [inline]
bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:40277
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x700000002 pfn:0x40277
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000700000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102328908, free_ts 72929691404
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:40276
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040277e00 pfn:0x40276
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888040277e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102319470, free_ts 72927574301
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6881 tgid 6880 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__folio_put+0x30d/0x3d0 mm/swap.c:126
folio_put include/linux/mm.h:1478 [inline]
put_page+0x21e/0x280 include/linux/mm.h:1550
page_pool_return_page+0x400/0x520 net/core/page_pool.c:692
page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline]
page_pool_scrub net/core/page_pool.c:1040 [inline]
page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053
page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126
xdp_test_run_teardown net/bpf/test_run.c:218 [inline]
bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:35859
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x35859
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102310144, free_ts 73030030444
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6045 tgid 6045 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
mm_free_pgd kernel/fork.c:803 [inline]
__mmdrop+0xd5/0x460 kernel/fork.c:919
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x7af/0xcc0 kernel/sched/core.c:5227
context_switch kernel/sched/core.c:5331 [inline]
__schedule+0xe5d/0x5730 kernel/sched/core.c:6690
__schedule_loop kernel/sched/core.c:6767 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6782
do_nanosleep+0x216/0x510 kernel/time/hrtimer.c:2032
hrtimer_nanosleep+0x146/0x370 kernel/time/hrtimer.c:2080
common_nsleep+0xa1/0xd0 kernel/time/posix-timers.c:1365
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1411 [inline]
__se_sys_clock_nanosleep kernel/time/posix-timers.c:1388 [inline]
__x64_sys_clock_nanosleep+0x344/0x4a0 kernel/time/posix-timers.c:1388
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:35858
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a4d0980 pfn:0x35858
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802a4d0980 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102300866, free_ts 73030030444
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6045 tgid 6045 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
mm_free_pgd kernel/fork.c:803 [inline]
__mmdrop+0xd5/0x460 kernel/fork.c:919
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x7af/0xcc0 kernel/sched/core.c:5227
context_switch kernel/sched/core.c:5331 [inline]
__schedule+0xe5d/0x5730 kernel/sched/core.c:6690
__schedule_loop kernel/sched/core.c:6767 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6782
do_nanosleep+0x216/0x510 kernel/time/hrtimer.c:2032
hrtimer_nanosleep+0x146/0x370 kernel/time/hrtimer.c:2080
common_nsleep+0xa1/0xd0 kernel/time/posix-timers.c:1365
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1411 [inline]
__se_sys_clock_nanosleep kernel/time/posix-timers.c:1388 [inline]
__x64_sys_clock_nanosleep+0x344/0x4a0 kernel/time/posix-timers.c:1388
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2614b
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2614b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102291193, free_ts 73033416654
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2614a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802614be00 pfn:0x2614a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802614be00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102282041, free_ts 73033416654
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4cfdf
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4cfdf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102272385, free_ts 73033425078
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4cfde
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804cfdfe00 pfn:0x4cfde
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804cfdfe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102262188, free_ts 73033425078
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d9c5
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x4d9c5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102251803, free_ts 73033429413
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d9c4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d9c5e00 pfn:0x4d9c4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804d9c5e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102200108, free_ts 73033429413
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:492af
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x700000002 pfn:0x492af
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000700000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102190568, free_ts 72847131991
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6882 tgid 6882 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
ptlock_alloc+0x1f/0x70 mm/memory.c:6907
ptlock_init include/linux/mm.h:2958 [inline]
pagetable_pte_ctor include/linux/mm.h:2985 [inline]
__pte_alloc_one_noprof include/asm-generic/pgalloc.h:73 [inline]
pte_alloc_one+0x74/0x360 arch/x86/mm/pgtable.c:33
do_fault_around mm/memory.c:5238 [inline]
do_read_fault mm/memory.c:5277 [inline]
do_fault mm/memory.c:5420 [inline]
do_pte_missing+0x1ae0/0x3e50 mm/memory.c:3965
handle_pte_fault mm/memory.c:5755 [inline]
__handle_mm_fault+0x100a/0x2a10 mm/memory.c:5898
handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6066
do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:492ae
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880492afe00 pfn:0x492ae
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880492afe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102180862, free_ts 72847131991
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6882 tgid 6882 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
ptlock_alloc+0x1f/0x70 mm/memory.c:6907
ptlock_init include/linux/mm.h:2958 [inline]
pagetable_pte_ctor include/linux/mm.h:2985 [inline]
__pte_alloc_one_noprof include/asm-generic/pgalloc.h:73 [inline]
pte_alloc_one+0x74/0x360 arch/x86/mm/pgtable.c:33
do_fault_around mm/memory.c:5238 [inline]
do_read_fault mm/memory.c:5277 [inline]
do_fault mm/memory.c:5420 [inline]
do_pte_missing+0x1ae0/0x3e50 mm/memory.c:3965
handle_pte_fault mm/memory.c:5755 [inline]
__handle_mm_fault+0x100a/0x2a10 mm/memory.c:5898
handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6066
do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:481cd
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x700000002 pfn:0x481cd
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000700000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102165592, free_ts 72937967817
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:481cc
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880481cc000 pfn:0x481cc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880481cc000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102155549, free_ts 72937967817
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:35489
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x35489
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102145620, free_ts 72937971810
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:35488
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035489e00 pfn:0x35488
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888035489e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102134945, free_ts 72937971810
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2e8a9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x2e8a9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102123883, free_ts 72937980743
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2e8a8
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802e8a9e00 pfn:0x2e8a8
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802e8a9e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102027856, free_ts 72937980743
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d5af
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4d5af
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102019271, free_ts 72938010095
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d5ae
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d5afe00 pfn:0x4d5ae
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804d5afe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102009797, free_ts 72938010095
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
getname_flags.part.0+0x4c/0x550 fs/namei.c:139
getname_flags+0x93/0xf0 include/linux/audit.h:322
vfs_fstatat+0x86/0x160 fs/stat.c:340
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:288f5
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x288f5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73102000312, free_ts 73033470915
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:288f4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880288f5e00 pfn:0x288f4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880288f5e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101990785, free_ts 73033470915
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2a5d3
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2a5d3
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101981344, free_ts 73033475710
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2a5d2
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a5d3e00 pfn:0x2a5d2
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802a5d3e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101971354, free_ts 73033475710
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:31fed
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x31fed
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101961425, free_ts 73033500378
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:31fec
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031fec000 pfn:0x31fec
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888031fec000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101951358, free_ts 73033500378
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d2eb
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4d2eb
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101941406, free_ts 73033504775
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d2ea
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d2ea000 pfn:0x4d2ea
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804d2ea000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101931115, free_ts 73033504775
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:492cf
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x700000002 pfn:0x492cf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000700000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101921296, free_ts 73033555599
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:492ce
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880492cfe00 pfn:0x492ce
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880492cfe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101911542, free_ts 73033555599
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2a5e3
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2a5e3
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101901939, free_ts 73033577957
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2a5e2
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a5e3e00 pfn:0x2a5e2
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802a5e3e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101892134, free_ts 73033577957
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:20e2b
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x20e2b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101882410, free_ts 73050505278
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:20e2a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020e2a000 pfn:0x20e2a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888020e2a000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101872513, free_ts 73050505278
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:303a9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x303a9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101862661, free_ts 73050513671
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:303a8
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880303a8000 pfn:0x303a8
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880303a8000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101852649, free_ts 73050513671
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4ee8f
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4ee8f
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101843593, free_ts 73050603571
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4ee8e
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804ee8fe00 pfn:0x4ee8e
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804ee8fe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101834464, free_ts 73050603571
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6897 tgid 6897 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141
alloc_empty_file+0x73/0x1e0 fs/file_table.c:209
path_openat+0xe1/0x2d60 fs/namei.c:3919
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4c81d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4c81d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101825213, free_ts 73033591465
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4c81c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804c81c000 pfn:0x4c81c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804c81c000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101815773, free_ts 73033591465
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2eddf
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2eddf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101806634, free_ts 73033611587
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2edde
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802edde000 pfn:0x2edde
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802edde000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101798037, free_ts 73033611587
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:31309
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000002 pfn:0x31309
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101789507, free_ts 73033671403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:31308
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031309e00 pfn:0x31308
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888031309e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101780175, free_ts 73033671403
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2ab7d
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x2ab7d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101771125, free_ts 73033675703
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:2ab7c
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802ab7de00 pfn:0x2ab7c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88802ab7de00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101762128, free_ts 73033675703
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d115
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4d115
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101752778, free_ts 73033698974
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:4d114
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d115e00 pfn:0x4d114
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff88804d115e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101742957, free_ts 73033698974
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:239bf
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x239bf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101733428, free_ts 73033703516
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:239be
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880239bfe00 pfn:0x239be
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff8880239bfe00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101724327, free_ts 73033703516
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:26e01
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x26e01
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101714857, free_ts 73033708088
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5356 tgid 5356 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638
__put_partials+0x14c/0x170 mm/slub.c:3145
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x199/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
tomoyo_realpath_from_path+0xb9/0x720 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822
security_inode_getattr+0x116/0x290 security/security.c:2373
vfs_getattr fs/stat.c:204 [inline]
vfs_fstat+0x53/0xd0 fs/stat.c:229
vfs_fstatat+0x146/0x160 fs/stat.c:338
__do_sys_newfstatat+0xa2/0x130 fs/stat.c:505
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 6902 Comm: syz.0.266 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
bad_page+0xb3/0x1f0 mm/page_alloc.c:501
free_page_is_bad_report mm/page_alloc.c:908 [inline]
free_page_is_bad mm/page_alloc.c:918 [inline]
free_pages_prepare mm/page_alloc.c:1100 [inline]
free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638
skb_free_frag include/linux/skbuff.h:3399 [inline]
skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096
skb_release_data+0x560/0x730 net/core/skbuff.c:1125
skb_release_all net/core/skbuff.c:1190 [inline]
__kfree_skb net/core/skbuff.c:1204 [inline]
sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640
__netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741
__netif_receive_skb_list net/core/dev.c:5808 [inline]
netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899
netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951
xdp_recv_frames net/bpf/test_run.c:279 [inline]
xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389
bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317
bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline]
__sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671
__do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c7d7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc9c77ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc9c7f36058 RCX: 00007fc9c7d7e719
RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a
RBP: 00007fc9c7df132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc9c7f36058 R15: 00007ffc6f158078
BUG: Bad page state in process syz.0.266 pfn:26e00
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888026e01e00 pfn:0x26e00
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff888023931000 0000000000000000
raw: ffff888026e01e00 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6902, tgid 6892 (syz.0.266), ts 73101705494, free_ts 73033708088
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457
__alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733
alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681
alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
__page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538
page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577
page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597
page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline]
xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305
bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389