Extracting prog: 2m9.011488631s Minimizing prog: 40m44.575154659s Simplifying prog options: 3m30.778393056s Extracting C: 1m46.427990923s Simplifying C: 0s extracting reproducer from 52 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash single: failed to extract reproducer bisect: bisecting 52 programs with base timeout 30s testing program (duration=43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 24, 5, 12, 6, 2, 2, 24, 16, 19, 30, 6, 30, 30, 28, 29, 30, 15, 30, 4, 8, 6, 29, 6, 7, 19, 4, 24, 24, 19, 24, 24, 24, 24, 3, 30, 1, 20, 12, 2, 30, 23, 30, 3, 18, 8, 4, 9, 17, 1, 30, 12] detailed listing: executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f0000000180)='`', 0x1, 0x488c0, &(0x7f0000000100)={0x21, 0x0, r1, 0x1, 0x4, 0x6, @broadcast}, 0x14) accept$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @rose}, [@null, @bcast, @rose, @default, @netrom, @remote, @remote, @null]}, &(0x7f0000000000)=0x48) executing program 3: rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) (async) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000600)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x17}, 0x5}, 0x1c) (async) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000c800) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) (async) r2 = gettid() r3 = getpid() rt_tgsigqueueinfo(r3, r2, 0x5, &(0x7f0000000140)={0x0, 0x0, 0x6}) (async) rt_sigtimedwait(&(0x7f0000000000)={[0xb2]}, &(0x7f0000000040), 0x0, 0x8) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) (async) listen(r5, 0x101) (async) r6 = socket$inet_dccp(0x2, 0x6, 0x0) (async) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r8) (async) setsockopt(r6, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) (async) connect$inet(r6, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x10) close_range(r4, 0xffffffffffffffff, 0x0) (async) r9 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r9, &(0x7f0000000300)={&(0x7f0000001080)={0x2, 0x4e20, @remote}, 0x10, &(0x7f00000074c0)=[{&(0x7f00000001c0)="a3", 0x1}], 0x1}, 0x0) recvmsg$kcm(r9, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x40000000) executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) r1 = shmget$private(0x0, 0x4000, 0x1000, &(0x7f0000ffb000/0x4000)=nil) shmctl$IPC_RMID(r1, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0xc1485544, &(0x7f00000003c0)=0x2000) executing program 3: syz_clone(0x8b0a600, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file1\x00', 0x28c) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0) mknodat$loop(r0, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') lsetxattr$trusted_overlay_nlink(&(0x7f0000000240)='./file1\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) llistxattr(&(0x7f0000000040)='./file1\x00', &(0x7f0000000180)=""/74, 0x4a) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) executing program 3: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwrite64(r0, &(0x7f0000000080)='3', 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a09040000000000000000020000000000010073f92bbfa2688c350c8e45eaf680e5797a31000000000900010073797a30000000000400020073797a3200000000140000001100"], 0x8c}, 0x1, 0x0, 0x0, 0x40094}, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r0, 0x4068aea3, &(0x7f00000000c0)={0xbe, 0x0, 0x1}) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="81ffffff010067656e65766500001400028005000a0000000000060005004e200000"], 0x44}}, 0x1004) executing program 32: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="81ffffff010067656e65766500001400028005000a0000000000060005004e200000"], 0x44}}, 0x1004) executing program 2: sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="1cf90103", @ANYRES16=0x0, @ANYBLOB="c89045b2a6c0b186f6eb1f00000008003617"], 0x1c}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b28, &(0x7f0000000000)={'wlan1\x00'}) socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f00000015c0)={0x34, 0xd, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) gettid() mprotect(&(0x7f0000d2a000/0xe000)=nil, 0xe000, 0x6) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000582000/0x2000)=nil, 0x800000}) r3 = socket(0x28, 0x2, 0x7) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000001c0)="3c75c2015e8724b5a4c586f2ae924b277f0443ec773eab27570e28988217c9b0", 0x20) r6 = accept$alg(r5, 0x0, 0x0) sendmsg$alg(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)="c3c6c0a2d26edc1a7a3a415836614200", 0x10}], 0x1, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r6, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000000800)=""/103, 0x67}], 0x1}}], 0x1, 0x32041, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2b, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x114}], 0x1}, 0x0) getsockopt(r3, 0x200000000114, 0x2711, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0x2a) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) sched_setaffinity(r1, 0x0, 0x0) getpgrp(0x0) gettid() socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f00000002c0)={0x2}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0xf) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000d84000)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) shutdown(r3, 0x1) sendto$inet6(r3, 0x0, 0x0, 0x20000003, &(0x7f0000b63fe4)={0xa, 0x2, 0xf5}, 0x1c) (fail_nth: 3) executing program 2: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @local}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xf, 0x4, 0x8, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000003c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="04"], 0x10) close(r2) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140), 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xc}, {}, {0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'ip6erspan0\x00'}]}}]}, 0x48}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellink={0xfffffffffffffcfb, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5}}, 0x20}}, 0x20008040) executing program 2: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x18) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) r4 = creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000002540)) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="20000000080000000007000900000000fffffff90000000900007fff00000007000000030000d06a"], 0x0, 0x600) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x1000)=nil, 0x930, 0x0, 0x11, r6, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x4000)=nil, 0x930, 0x0, 0x12, r6, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x28011, r7, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f000007f000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, 0x0}], 0x1, 0x10, &(0x7f00000004c0)=[@cr4={0x1, 0x14242f}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002a80)="8506093cf7918f92660dfd9d617cdc925aadd426edd496eacb3e7e25fa8bfb5d31a7b6146c855a546f2bfd6b63c2e0b3e7ce52d3bb41f613e885f0e91605412d1afef724bc3690ba2ebc5d76911af1b00bb3fa481fbb52419b17703f7e38d02cd922efd1348ceb3a80c435d1ed84c61d0432338432e3fc757f8c66db532539b2009989bd9ed9ec14c37a2ce3cf90136f061eccbae6b5a6851f4cb3f974ec4dce5c5e2cd6b9fe872e85333d757176e7fea1f66061ea2053d97ea477c53fbd4dc9b07d38c595f71c1a49af408b4b1187cb5b5487279d063b465d417a9dcc506e6866bc79df5f02c63e1ca733cad395ffc7f074136f2748edfb8800421541f2e9dde40d68fb1b4b818512714fdd8594e2f4718287470384f6e153ccb6d986ad03b479597fe6293091dd1bf4973e69292ad5f65227ecba45f01e6a463ecd1d24c52d26e59e35bb04a27a81bbd31f3e377d976f433555a48dd8722b16109ee0ddc441f156a0ad0a20b289bf5b0648797e52ffd8dbe77e03297e21bfb0c191625c8eee6423f182831f2d67e5796e7f69450cc8d2e2fa4ece8e5463a115d99c6ac5bbf95330f3c90e466630d0d2b0e044570dec21fc8c6b8102fec6fcba485e909202faf95a7d36ae09d5b0d1f42863d6143e27cdd78a7c67dbb15ece1af59412867ca9d186ffe9de680e747740d72ea6dfa28411de13f42d112c30060330668f27feb9d222d485ff5b98c10415780526d26b9731c4ddd6291204ed8189cebf4d31f2ec61c9de41321f04452061e1bc28629770ef3b19676eea1bac63b9385a393f36ff7f359ae03567ee03c97e26b69e1509ec61123c28840211287add4a92162422039e787f2ce7331f3f8029b4721abc701eefc67d8e81a10b7dc83d8001d375dc84a68ef054035e7eed4cbd1c2553430f75bdb6f7acc3793215edd5638584aa7226c6c907b7845f488220ff8c6ab75b75c7ad4d7912846088024741112e181583e70f10cdc0f86c3d7e8b318c36e256af072c2ddfaf1aab7e553d37cf7b8810c63fc15794295653ef75d9fafec42525f582c89d41e59e85ed2ec12b394c1bf3adfee33db4ccf3b53fb2634378a2dd7625a0af3383bea6533516657cdbb8c2739b1b156a8973cd452d4d9cc21419d0d5fc4d41e9f07c476e6662869affae0c97cbfd2d691b78693428385496830cf03906267393a5c229236377040b9368a987f2edfaca0e57730588249ac9bbd027f918938626c083b0dd14730c36023a201e71e9786faca6be137e27725f7ce92afe4bd3d7ce7bab99f37ce9338b8b394a1970355b5becb2b165f3b3d0c0f5a1bd0242e16afc1fac445dd17399319e6c487c9d671e4efa843336ea475d4e898bad6b145cc2f68fd0ea768efd2e4cc2ee927145132a1daf62ce471363cfabb638c194d89922bba563b7abb6918ab297688ae01f49b3bb674f2c05b5be00710b7ea329e0cefb6fa936cff17b3b6daca20834e0701ffa2c6a32c77c03060a8ddfb1cc019b69f39fe6f04e7fa4fb689257279f4c7fced441d2cee456e2dea25ec9a58daf1bdcdc405d488a96642f3b85fd1333eff2d9494718a51ec1e4688d7d11ba3a141f23b2d8a0376a78f30aae688909011ae67a5c6567f2a2b52234d4eef22b9db78f602591d61a90d9c0e2e0aabab62961fdca0871aeb01288f745675a422a4e5305d248978470b5c38e6e911b530cc5df06e159ea2806df649c529c4ea3b829b89a8d2d9bdc7c253eb4b284de505d0089efbbebb34b922e6864dbba4b721632a2e602ca22ca72dc005d013932303be333bb9f6229732ac2ff2dd791171d4ec4ffa8cc972ccdebb0b407fdff12a024932710efdfc82fa1a30d6f066dfae3845fe4e79d4cd9db85de46d1403ed90968c293405cc187c83d443ef57ef666577c4d95cf476c15267153d184a409dcaae4993aaefe19910d51fec949c872b327db8a588fa10ccc06bff853d84ae46835d32ed630348e", 0x581) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001d40)={&(0x7f0000000580)={0x3c, 0x0, 0x809, 0x0, 0x0, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x3c}}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0xa8, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0x46, 0xa8, @random="6bad1e3a51af06617d1e0b193ffd6abd0f1fbfae9eda1d91110f365d78ff80f31d8db655440cb1a5d297037bf83b17edda99509661bf4d28b66df7c6315bf3655eaf"}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4800}, 0x8040) bpf$MAP_CREATE(0x0, 0x0, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000580)=""/277, 0x115) lseek(r0, 0x400, 0x1) getdents64(r0, &(0x7f00000000c0)=""/162, 0xa2) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', r0, &(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000004440)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x0) executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE(r0, &(0x7f0000000080)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/44, 0x2c, 0x8, 0x4, 0x2, 0x2, 0x41}}, 0x120) socket$nl_generic(0x10, 0x3, 0x10) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000200)={r0, 0xa6, 0x101, 0xffffffffffffff49}) sendto$inet6(r2, &(0x7f0000000240)="d2bf2e474d5c07736b61067c92f41d89b47d5250d1976073f3461f74539478367bed4be73f637b5f189e3311c0a103fc29c7efea5eb4f0ee140699928f8c6f9e30d643bc1ad92a6eda48e673ca46b03ff3e41dd00a99b4b50a86a21a0e9b665bb1c1b04d3e5c63fccec70fc9d9942c90d1ff6966864aae23df9350243ce771a2d8e021a823eff7387973e494b409f82f51e467d30c6048b12eb896d4a895fd2626154256bec5359b7658603fa5c736a74e6743a63b9c42", 0xb7, 0x810, &(0x7f0000000300)={0xa, 0x4e20, 0x7, @mcast2, 0x8000}, 0x1c) readv(r2, &(0x7f0000000440)=[{&(0x7f0000000340)=""/255, 0xff}], 0x1) ioctl$CDROMRESUME(r2, 0x5302) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x38, "b40dbd18a1a60cba39b1b6c2ef9a8053389960e5169e66ab7bc9317bc14cb413656c44708945e5c609453fcc750ff702f30021061f0e1771"}, &(0x7f00000004c0)=0x40) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000500)={0x5, 0x0, 0x723, 0xe, 0xff}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000580)={'veth1\x00', &(0x7f0000000540)=@ethtool_eeprom={0xb, 0xfffffffa, 0x7fff, 0x3, "0d2393"}}) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f00000005c0)=0x11, 0x4) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000640)=@gcm_256={{0x304}, "692964e5f181a3ca", "b7e8adb91ee46a78688bc5b5b5880798e2817f8384ac5325abeb5b6b749e3f1c", "42c83b9b", "4ae56aaead17b040"}, 0x38) setsockopt$MRT_FLUSH(r2, 0x0, 0xd4, &(0x7f0000000680)=0x1, 0x4) r5 = signalfd(r3, &(0x7f00000006c0)={[0x9]}, 0x8) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000740)={'ip_vti0\x00', 0x0, 0x0, 0x10, 0x2, 0xbfc0, {{0x15, 0x4, 0x0, 0x4, 0x54, 0x65, 0x0, 0x7, 0x29, 0x0, @private=0xa010101, @private=0xa010101, {[@timestamp_prespec={0x44, 0x14, 0xff, 0x3, 0xa, [{@dev={0xac, 0x14, 0x14, 0x21}, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}]}, @timestamp_prespec={0x44, 0x2c, 0x30, 0x3, 0x4, [{@broadcast, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@multicast1, 0x5}, {@broadcast, 0x10000}, {@rand_addr=0x64010102, 0xaf5e}]}]}}}}}) sendmsg$nl_route(r5, &(0x7f00000008c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)=@ipv4_getaddr={0x4c, 0x16, 0x4, 0x70bd26, 0x25dfdbff, {0x2, 0x10, 0x80, 0xfd, r6}, [@IFA_FLAGS={0x8, 0x8, 0x2}, @IFA_RT_PRIORITY={0x8, 0x9, 0x7fffffff}, @IFA_ADDRESS={0x8, 0x1, @multicast2}, @IFA_CACHEINFO={0x14, 0x6, {0xfffffff8, 0x0, 0x68, 0x1}}, @IFA_FLAGS={0x8, 0x8, 0x40}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000000}, 0x20000000) r7 = syz_open_dev$vim2m(&(0x7f0000000900), 0x70, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000940)={0xd, 0x2, 0x1, "de5eca91c6df08c7f0c50c305988595955e32a35dd9259b3e82863d597745f14", 0x41414270}) fsetxattr(r5, &(0x7f0000000980)=@random={'os2.', '\x00'}, &(0x7f00000009c0)='{@+$.&),#}\'\x00', 0xc, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000cc0)={r1, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000a80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3e, &(0x7f0000000ac0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000b00), &(0x7f0000000b40), 0x8, 0xe9, 0x8, 0x8, &(0x7f0000000b80)}}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000d00)={r2, r6, 0x25, 0xa, @val=@tracing={r8, 0xd}}, 0x20) syz_io_uring_setup(0x1724, &(0x7f0000000d40)={0x0, 0xd4e9, 0x20, 0x1, 0x3e5}, &(0x7f0000000dc0)=0x0, &(0x7f0000000e00)) syz_io_uring_setup(0x4be, &(0x7f0000000e40)={0x0, 0x884b, 0x40, 0x0, 0x249, 0x0, r2}, &(0x7f0000000ec0), &(0x7f0000000f00)=0x0) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000f80)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, r2, 0x0, &(0x7f0000000f40)='./file0\x00', 0x42, 0x200000, 0x23456, {0x0, r11}}) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0xab7392fcac8c6099}, 0xc, &(0x7f0000001400)={&(0x7f0000001040)={0x3c0, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}, @TIPC_NLA_MEDIA={0x80, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x48c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x317}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x454}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffeff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x69}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}]}, @TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @local}}, {0x14, 0x2, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x40}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xde3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb026}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x43, @local}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x672, @mcast1, 0x2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}]}, @TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8af3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa5e4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf944}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x488}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x476}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x108, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x837d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfea5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9f22}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}, @TIPC_NLA_NODE={0x38, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ID={0x4}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9c764c2437de719eaabc3a68cbc03793007e0f45"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x3c0}, 0x1, 0x0, 0x0, 0x4010}, 0x20000000) executing program 33: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE(r0, &(0x7f0000000080)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/44, 0x2c, 0x8, 0x4, 0x2, 0x2, 0x41}}, 0x120) socket$nl_generic(0x10, 0x3, 0x10) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000200)={r0, 0xa6, 0x101, 0xffffffffffffff49}) sendto$inet6(r2, &(0x7f0000000240)="d2bf2e474d5c07736b61067c92f41d89b47d5250d1976073f3461f74539478367bed4be73f637b5f189e3311c0a103fc29c7efea5eb4f0ee140699928f8c6f9e30d643bc1ad92a6eda48e673ca46b03ff3e41dd00a99b4b50a86a21a0e9b665bb1c1b04d3e5c63fccec70fc9d9942c90d1ff6966864aae23df9350243ce771a2d8e021a823eff7387973e494b409f82f51e467d30c6048b12eb896d4a895fd2626154256bec5359b7658603fa5c736a74e6743a63b9c42", 0xb7, 0x810, &(0x7f0000000300)={0xa, 0x4e20, 0x7, @mcast2, 0x8000}, 0x1c) readv(r2, &(0x7f0000000440)=[{&(0x7f0000000340)=""/255, 0xff}], 0x1) ioctl$CDROMRESUME(r2, 0x5302) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x38, "b40dbd18a1a60cba39b1b6c2ef9a8053389960e5169e66ab7bc9317bc14cb413656c44708945e5c609453fcc750ff702f30021061f0e1771"}, &(0x7f00000004c0)=0x40) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000500)={0x5, 0x0, 0x723, 0xe, 0xff}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000580)={'veth1\x00', &(0x7f0000000540)=@ethtool_eeprom={0xb, 0xfffffffa, 0x7fff, 0x3, "0d2393"}}) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f00000005c0)=0x11, 0x4) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000640)=@gcm_256={{0x304}, "692964e5f181a3ca", "b7e8adb91ee46a78688bc5b5b5880798e2817f8384ac5325abeb5b6b749e3f1c", "42c83b9b", "4ae56aaead17b040"}, 0x38) setsockopt$MRT_FLUSH(r2, 0x0, 0xd4, &(0x7f0000000680)=0x1, 0x4) r5 = signalfd(r3, &(0x7f00000006c0)={[0x9]}, 0x8) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000740)={'ip_vti0\x00', 0x0, 0x0, 0x10, 0x2, 0xbfc0, {{0x15, 0x4, 0x0, 0x4, 0x54, 0x65, 0x0, 0x7, 0x29, 0x0, @private=0xa010101, @private=0xa010101, {[@timestamp_prespec={0x44, 0x14, 0xff, 0x3, 0xa, [{@dev={0xac, 0x14, 0x14, 0x21}, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}]}, @timestamp_prespec={0x44, 0x2c, 0x30, 0x3, 0x4, [{@broadcast, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@multicast1, 0x5}, {@broadcast, 0x10000}, {@rand_addr=0x64010102, 0xaf5e}]}]}}}}}) sendmsg$nl_route(r5, &(0x7f00000008c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)=@ipv4_getaddr={0x4c, 0x16, 0x4, 0x70bd26, 0x25dfdbff, {0x2, 0x10, 0x80, 0xfd, r6}, [@IFA_FLAGS={0x8, 0x8, 0x2}, @IFA_RT_PRIORITY={0x8, 0x9, 0x7fffffff}, @IFA_ADDRESS={0x8, 0x1, @multicast2}, @IFA_CACHEINFO={0x14, 0x6, {0xfffffff8, 0x0, 0x68, 0x1}}, @IFA_FLAGS={0x8, 0x8, 0x40}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000000}, 0x20000000) r7 = syz_open_dev$vim2m(&(0x7f0000000900), 0x70, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000940)={0xd, 0x2, 0x1, "de5eca91c6df08c7f0c50c305988595955e32a35dd9259b3e82863d597745f14", 0x41414270}) fsetxattr(r5, &(0x7f0000000980)=@random={'os2.', '\x00'}, &(0x7f00000009c0)='{@+$.&),#}\'\x00', 0xc, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000cc0)={r1, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000a80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3e, &(0x7f0000000ac0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000b00), &(0x7f0000000b40), 0x8, 0xe9, 0x8, 0x8, &(0x7f0000000b80)}}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000d00)={r2, r6, 0x25, 0xa, @val=@tracing={r8, 0xd}}, 0x20) syz_io_uring_setup(0x1724, &(0x7f0000000d40)={0x0, 0xd4e9, 0x20, 0x1, 0x3e5}, &(0x7f0000000dc0)=0x0, &(0x7f0000000e00)) syz_io_uring_setup(0x4be, &(0x7f0000000e40)={0x0, 0x884b, 0x40, 0x0, 0x249, 0x0, r2}, &(0x7f0000000ec0), &(0x7f0000000f00)=0x0) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000f80)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, r2, 0x0, &(0x7f0000000f40)='./file0\x00', 0x42, 0x200000, 0x23456, {0x0, r11}}) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0xab7392fcac8c6099}, 0xc, &(0x7f0000001400)={&(0x7f0000001040)={0x3c0, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}, @TIPC_NLA_MEDIA={0x80, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x48c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x317}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x454}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffeff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x69}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}]}, @TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @local}}, {0x14, 0x2, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x40}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xde3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb026}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x43, @local}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x672, @mcast1, 0x2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}]}, @TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8af3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa5e4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf944}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x488}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x476}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x108, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x837d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfea5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9f22}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}, @TIPC_NLA_NODE={0x38, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ID={0x4}]}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9c764c2437de719eaabc3a68cbc03793007e0f45"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x3c0}, 0x1, 0x0, 0x0, 0x4010}, 0x20000000) executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@remote, @empty, 0x1, "4ef7289910e0843a8f13f2fe244b73fb24e0fe49951c925bca907f6a609d8f49"}, 0x3c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x6e, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000000)) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r7, 0xc01864b0, &(0x7f0000000080)={0x0, 0x0, 0xb}) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000}) ioctl$KVM_NMI(r8, 0xae9a) ioctl$KVM_RUN(r8, 0xae80, 0x0) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f00000002c0), 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="6c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800b000100697036746e6c000034000280e7ff030001000000140003000000000000000000000000000000000014000200fe80000000000000000000000000000e08001f0068000000"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r9 = creat(&(0x7f0000000240)='./file0\x00', 0x0) ioctl$IMDELTIMER(r9, 0x80044941, &(0x7f00000002c0)=0x3) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000180)) ioctl$F2FS_IOC_RESIZE_FS(r8, 0x4008f510, &(0x7f0000000340)=0x8) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f00000000c0)={@hyper}) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket(0x10, 0x3, 0x0) io_setup(0x8, &(0x7f0000000000)=0x0) r3 = eventfd2(0x0, 0x0) io_submit(r2, 0x1de, &(0x7f00000002c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000400)="f7624a800e6dc300a7c8af1073f7f80565d85cb0e73f45f4f3d53666f000784332e6113ff3e3a0d49c7ea76f4a31561cf1828eae6bec281c2a70ddd7a233e68eba25eff429708fdad8cd4dc88934bf913ef2a79bd435292a074c9a8a298e27f22767d72c2d10aa827a7c6f0d6779605e2612dfc3dddcdd7a0e", 0x8}]) io_destroy(r2) writev(r3, &(0x7f0000000480)=[{&(0x7f0000000340)="7e9adf65e9c6bafa", 0x8}], 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) tee(r1, r1, 0xb9, 0xa) r4 = fsmount(0xffffffffffffffff, 0x0, 0x102) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$inet6(0xa, 0x3, 0x7) close_range(r5, 0xffffffffffffffff, 0x0) open_by_handle_at(r5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1c1900008200001ac1691a00000000000000a1f4ce917400"/33], 0x0) msync(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r4) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_udp(0xa, 0x2, 0x0) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) accept4$unix(r1, 0x0, &(0x7f0000000240), 0x80000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000002c0)='ext4_ext_convert_to_initialized_fastpath\x00', r7}, 0x10) sendmmsg$inet(r6, &(0x7f0000002f80)=[{{&(0x7f0000000080)={0x2, 0x4e23, @remote}, 0x10, 0x0}}, {{&(0x7f0000000300)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_ttl={{0x14, 0x0, 0x34}}], 0x18}}], 0x2, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0xc0f85403, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000040)={0xdb}, 0x8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, 0x0, &(0x7f0000000280)}, 0x20) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/42, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000001c0)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000280)=""/59}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000005c0)={0x2, 0x0, [{0x104000, 0x8c, &(0x7f0000000480)=""/114}, {0x0, 0xa8, &(0x7f0000000500)=""/168}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd, @void, @value}, 0x90) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) getpgid(0xffffffffffffffff) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYRES32, @ANYBLOB="e201330080000000ffffffffffff0802110000000b605fcc36fc0000000000000000000064002000000004060000000000000602000005040000006825030000002a01003c04010008012d1a0000000000000000000000000000000000000000000000000000710700000000000000dd88", @ANYRESHEX], 0x200}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) sched_setscheduler(0x0, 0x0, 0x0) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000940)=ANY=[@ANYBLOB="620af8ff0c200021bfa13ed4af83dfefbdbf0000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc56f8bff7246b3013a69935304465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b22d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa09000000083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f46306000000442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff35405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e658795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e59581fb59d9c14a1919899e52c335e2bc5d90986733991b6e012396dd938daa468c9cf34e3101c5889005c31ab80f6a457333db07d035c29f27117541af654cb6a03d2b93c0ac1cec32e706ed42"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000140)={0x0, 0xfffffffc}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x3}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@ipv6_newroute={0x44, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_ENCAP={0x18, 0x16, 0x0, 0x0, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x0, {0x0, 0x0, 0x10}}}}}, @RTA_OIF={0x8, 0x4, r5}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x6}]}, 0x44}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002940)=ANY=[@ANYRESHEX=r5, @ANYRES64=r6, @ANYBLOB="0600000000000000000000000000000000000000abc422a9311061ac02bc7141b7b2020e10da9703c810d606a481db375a1a1e79303780ab249de81e5249ecad6207ec3ae350609b41f09281cc675f16293f52ae54ad7078361ef5", @ANYRESHEX=r3, @ANYRES64=r2, @ANYRES64=r3, @ANYRES32=r1, @ANYRES16=r5], 0x50) ioctl$TUNGETDEVNETNS(r2, 0x40086602, 0x1000000000000000) lseek(r2, 0x8, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x8000000000000000, 0x2) executing program 5: openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4400ff7f10005bd300"/20, @ANYRES32=0x0, @ANYBLOB="81ffffff000000001c0012800b00010067726574617000000c000280080001"], 0x44}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f00000000c0)="390000001000111867090707a640400f0021ff3f30000000170a00170000000004003700090003", 0x27}], 0x1) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000080)=@newtaction={0x60, 0x30, 0x0, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_skbedit={0x48, 0x1, 0x0, 0x0, {{0xc}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc, 0x9}}}]}]}, 0x60}}, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)={0x44, 0x0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x19}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}]]}, 0x44}}, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e02003c000b05d25a806f8c6394f90324fc602f00001550000100053582c137153e370248018088a817008847", 0x33fe0}], 0x1}, 0x0) r2 = accept$alg(r0, 0x0, 0x0) r3 = open(&(0x7f0000000140)='./file1\x00', 0x10f0c2, 0x0) ftruncate(r3, 0x200004) sendfile(r2, r3, 0x0, 0x1000000000204) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) recvmsg(r2, &(0x7f0000000bc0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x0, 0x4c, 0x1a, 0x0, 0x25, 0x228, 0x258, 0x258, 0x228, 0x258, 0x3, 0x0, {[{{@ipv6={@mcast2, @loopback, [], [], 'wg2\x00', 'macvlan1\x00'}, 0x0, 0x108, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@statistic={{0x38}, {0x0, 0x3b0}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@local, 'team_slave_1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) getdents64(r5, &(0x7f0000000580)=""/277, 0x115) lseek(r5, 0x400, 0x1) getdents64(r5, &(0x7f00000000c0)=""/162, 0xa2) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$sock_buf(r6, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r3, 0x0) madvise(&(0x7f0000600000/0x3000)=nil, 0x3000, 0xb) syz_clone(0x62280100, &(0x7f0000000700)="984437729f8e9837b6f4cbaa406516626d44bf53c228f384b106858b4645b30a890783268342bffc286d080b59071bc040f07c3837d4db827160c77ae2107123f5524988ddf55ea6e4469ed0e2502472321d405f8c128a979cff478cdec2e0d90a88ecc387519be718aa490a80443f3693bef6962698620f32c56ab3b772f86588353f066824e01df4772dc10258b728d4833b24241cee07063b4c8138937e64b2a426c1629920c6d1a0f16dd2f783c14b623354721f10f475f1ca5ee2a0c3c9b395df9150d9e43942bd84cea205c1cf3199e92af4b8777faf0684929063fb3731a128e6d6c21d217fad839a379b1504e8be8542148001ecea8ea10a78efc291c03481c12b9f572d4b14979dcc739dae889e6897340711ce4ea84c3cc01f532d79fb2e92d7eb9d56c52b9916d1306bcf03f4ab1cf481c34452a5da77b3321682dbeadd7044f63ff0d16f73bbff6915d3a6371444b6f603a8b4099a5f1cd7809be44afdf864437691c5530fc4f0f9852df2dcd62787ffc4adda34b2db88b5fb9fbdf217ff0727d2e5161a5b2a7f5f271a36a3d637c9e10c8b8900f0521fc90f215a3d1d6fa1bb27ea67542922ef52d84380a4cd9019ca89c58a1acfb64b", 0x1bd, 0x0, 0x0, 0x0) executing program 5: creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddfa) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x9) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) executing program 4: unshare(0x2a000600) r0 = syz_io_uring_setup(0x5c23, &(0x7f0000000240)={0x0, 0x0, 0x13290}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x22e881, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r3, &(0x7f0000000080)=[{&(0x7f0000000000)=""/88, 0x58}], 0xd, &(0x7f0000000140)=[{&(0x7f0000002280)=""/4096, 0x1000}], 0x1, 0x0) io_uring_enter(r0, 0x1, 0x0, 0x1, 0x0, 0x1000000) executing program 4: munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) (async, rerun: 64) creat(&(0x7f0000000040)='./bus\x00', 0x0) (rerun: 64) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00') (async) mount(&(0x7f0000000000)=@sr0, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x147842, 0x0) preadv2(r0, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x0) executing program 4: sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c000000000000040000000000000900010073797a31000000001c0004800800f2400000000008000540080000000800084000000000"], 0x3c}}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) syz_usb_connect$hid(0xf63067478e218e8, 0x36, &(0x7f0000000040)=ANY=[], 0x0) (async) syz_usb_connect$hid(0xf63067478e218e8, 0x36, &(0x7f0000000040)=ANY=[], 0x0) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) (async) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx2\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$pvfs2(&(0x7f00000001c0), &(0x7f0000000200)='./file1\x00', &(0x7f0000000280), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x2, 0x0}, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000f, 0x1010, r3, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$unix(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000002c0)="62a82aee345fd487f498e794884ad2eddcae95f5cc9dbaf5f323c9c7d668443ac0c99266d2bf82b41b2a853dff952d0d265497132539c94b71389d21044b108aa251a96431eaca", 0x47}, {&(0x7f00000000c0)="2bf1a315589752e28ab9b9ae48406664fbd5a462d22d71c7d63bc55f5cddadab05dd3b134ded0f6ec5c004a8110a", 0x2e}, {&(0x7f0000000440)="97c1f67518fa08076e8fb8", 0xb}], 0x3}, 0x0) (async) sendmsg$unix(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000002c0)="62a82aee345fd487f498e794884ad2eddcae95f5cc9dbaf5f323c9c7d668443ac0c99266d2bf82b41b2a853dff952d0d265497132539c94b71389d21044b108aa251a96431eaca", 0x47}, {&(0x7f00000000c0)="2bf1a315589752e28ab9b9ae48406664fbd5a462d22d71c7d63bc55f5cddadab05dd3b134ded0f6ec5c004a8110a", 0x2e}, {&(0x7f0000000440)="97c1f67518fa08076e8fb8", 0xb}], 0x3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="7800000039000900000f0f000000000001000000040000000c000180cafc080005470000080002"], 0x78}}, 0x0) executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000006c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x558, 0x368, 0xd0, 0x0, 0x1b0, 0x0, 0x488, 0x488, 0x488, 0x488, 0x488, 0x6, 0x0, {[{{@ipv6={@mcast2, @private1, [], [], 'macvlan1\x00', 'erspan0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff}, {}, 0x203}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5b8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r1, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_async', 0x902, 0x40) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) r2 = syz_io_uring_setup(0x620, &(0x7f0000000300)={0x0, 0x0, 0x2}, &(0x7f0000000140)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000380)=@IORING_OP_ACCEPT={0xd, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x528c0ed6c66125f3}) open_tree(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xb00) io_uring_enter(r2, 0x2def, 0x0, 0x0, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)={0x34, r1, 0x1, 0x0, 0x0, {0x1d}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) syz_emit_ethernet(0x176, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaa48847000000000000000000000000603f599001340600fe8000000000000000000000000000aafe8000000000000000000000000000000000000000000000c204000000000000000c000000000000fc02000000000000000000000000000000000000000000000000ffff00000000fe800000000000000000000000000000fe80000000000000000000000000000000000000000000000000000000000000fc00"/190, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50000000907800006c3e4af6e95497a4e1f23137ae5d9ab0d6a6a3ff1ff52b15b109af0f93abe7bddfe72723968479f91c26bda6d7d589fb8cb68c4f8760051117d27ab8434eb2818254ab55825a80ba277e953c42c3e3a34d6f1998abd85935442e96e25dc77ffb0469578ffae16aa69caf18e96b08085370c0c242147969cf393604407755c55c4b539a2e36241dc73a3d65b8b2585660c1365e7ec6c7a536a08d21e53aa4e60cad0bd8eb60a00943"], 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000050000f51b0001c0"]) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}}) (async) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="8b"], 0x53) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000008c0)={0xe, 0x18, 0xfa00, @ib_path={0x0}}, 0x20) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x0, 0xb00, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc}]}], {0x14, 0x10}}, 0xa0}}, 0x0) write$binfmt_elf64(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000800000003003c02ffffffef3501"], 0x7c8) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000680)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) llistxattr(&(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x0) (async) r8 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="0401020028000b05d25a806f8c6394f90524fc600d00030004000100ff3582c137153e370248018010001700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 34: creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddfa) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x9) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) syz_emit_ethernet(0x176, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaa48847000000000000000000000000603f599001340600fe8000000000000000000000000000aafe8000000000000000000000000000000000000000000000c204000000000000000c000000000000fc02000000000000000000000000000000000000000000000000ffff00000000fe800000000000000000000000000000fe80000000000000000000000000000000000000000000000000000000000000fc00"/190, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50000000907800006c3e4af6e95497a4e1f23137ae5d9ab0d6a6a3ff1ff52b15b109af0f93abe7bddfe72723968479f91c26bda6d7d589fb8cb68c4f8760051117d27ab8434eb2818254ab55825a80ba277e953c42c3e3a34d6f1998abd85935442e96e25dc77ffb0469578ffae16aa69caf18e96b08085370c0c242147969cf393604407755c55c4b539a2e36241dc73a3d65b8b2585660c1365e7ec6c7a536a08d21e53aa4e60cad0bd8eb60a00943"], 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000050000f51b0001c0"]) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}}) (async) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="8b"], 0x53) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000008c0)={0xe, 0x18, 0xfa00, @ib_path={0x0}}, 0x20) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x0, 0xb00, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc}]}], {0x14, 0x10}}, 0xa0}}, 0x0) write$binfmt_elf64(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000800000003003c02ffffffef3501"], 0x7c8) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000680)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) llistxattr(&(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x0) (async) r8 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="0401020028000b05d25a806f8c6394f90524fc600d00030004000100ff3582c137153e370248018010001700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) socket$inet6(0xa, 0x1, 0x6) chdir(&(0x7f00000000c0)='./bus\x00') r0 = creat(&(0x7f0000000040)='./file0\x00', 0x48) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000180)={0x36, 0x1, 0x1, "0088f200000000000000000000000096c300", 0x32314d56}) fcntl$setstatus(r0, 0x4, 0x2000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = socket(0x15, 0x5, 0x0) bind$packet(r3, &(0x7f0000000100)={0x11, 0x18, 0x0, 0x1, 0x5, 0x6, @remote}, 0x14) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000000680)=""/102400, &(0x7f0000000040)=0x19000) sync() r4 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYRES32=r2], 0x38}}, 0x0) io_submit(r2, 0x1, &(0x7f0000000700)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780)="550801", 0x3, 0x0, 0x0, 0x0, r0}]) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000040)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x6) executing program 6: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018004000800395032303030"], 0x15) r2 = dup(r1) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) setsockopt$RDS_GET_MR(r3, 0x114, 0x6, &(0x7f0000000440)={{0x0}, 0x0}, 0x20) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r4, &(0x7f0000000300)=""/104, 0x68) getdents(r4, 0x0, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000c80)={{{@in6=@mcast2, @in6=@dev={0xfe, 0x80, '\x00', 0x1e}, 0x0, 0x3d88, 0x0, 0x0, 0xa, 0x10, 0x40, 0x3b, 0x0, 0xee01}, {0x0, 0x4000003, 0x0, 0x0, 0x0, 0x0, 0x10001}, {}, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x0, 0x32}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c) r6 = accept4$llc(r4, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x800) write$P9_RLERRORu(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f00000002c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @private2}}}, 0x30) write$binfmt_elf64(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="7f450700000053c407cd"], 0x7c8) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000380), 0x421000, &(0x7f0000000640)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@cache_none}, {@access_any}, {@msize={'msize', 0x3d, 0x10}}, {@version_9p2000}], [{@uid_eq={'uid', 0x3d, r8}}, {@fsmagic={'fsmagic', 0x3d, 0xfffffffffffffffc}}, {@mask={'mask', 0x3d, '^MAY_READ'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@euid_lt={'euid<', r8}}, {@smackfshat={'smackfshat', 0x3d, 'access=any'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@subj_type={'subj_type', 0x3d, '\x00'}}], 0x6b}}) syz_emit_ethernet(0xda, &(0x7f0000001600)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xcc, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x2a, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private, @local, {[@cipso={0x86, 0x2a, 0x0, [{0x0, 0xd, "5e000000ff000000000000"}, {0x0, 0x5, "4eb8a6"}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x13, 0x0, [@dev, @loopback, @loopback, @multicast2]}, @cipso={0x86, 0x4c, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0xa, "2189ea43a2149b84"}, {0x0, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x0, 0x9, "02a20948fd7406"}, {0x0, 0xe, "ccf0294e2a3bdb4aa40b249e"}]}, @timestamp={0x44, 0x8, 0x0, 0x0, 0x0, [0x0]}]}}, "a815a23da43974ff"}}}}}, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r10 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r12 = accept4(r11, 0x0, 0x0, 0x0) sendmsg$unix(r12, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="e077494ceddc98fd3a7c67ab1ab412e5fd48209c95ad2dcf9dd820ef62bacac905d3a926ebfb27d2b3fe293842b37c59ac7bc7d5cadc6ad79f0a0e86f1a39eb725584ab91372c08fd3b56eded2", 0x4d}, {&(0x7f00000000c0)="3bf764bac88298e99ad46d79a52f48786c69c5689656c8a6e9af002e752498602595d2cee9ea5847ec4260acd66b9efd9880282d97f1d23b959fa5db77af419517d0a46cf85d6c706392a8dc33fbf61af711ea19a9820aa5d12123bf3460a846eb9f6d5f9720dcd27cd54399c0c7a24af2e63f", 0x73}], 0x2}, 0x0) sendfile(r10, r9, 0x0, 0x100800001) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1a00fe00000000bfa10000000a000007010000f8ff6fffb702000008000000b70300000000000085000000c700000095"], &(0x7f0000000040)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 6: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x880) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r2 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000400)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000440)=0x1c, 0x800) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x42, 0x0) pwritev2(r3, &(0x7f00000008c0)=[{&(0x7f0000000240)="e7", 0x1}], 0x1, 0x0, 0x0, 0x20) setsockopt$inet6_opts(r2, 0x29, 0x36, &(0x7f0000000480)=@dstopts={0x4, 0x3, '\x00', [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x81}, @ra={0x5, 0x2, 0x1}, @enc_lim={0x4, 0x1, 0x3}, @enc_lim={0x4, 0x1, 0x16}, @jumbo={0xc2, 0x4, 0x10000}]}, 0x28) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='macvlan1\x00', 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @broadcast}, 0x10) mq_open(&(0x7f0000000140)='{\x00', 0xc2, 0x10, &(0x7f0000000180)={0x3, 0xe45, 0x2, 0x4}) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r0, &(0x7f00000001c0)={0xa0, 0x19, 0x1, {0x80, {0x8, 0x0, 0x2}, 0x9, 0xffffffffffffffff, r4, 0xfff, 0x1, 0x3, 0x3, 0xffffffffffff0000, 0x8000000000000001, 0xbf65, 0x2, 0x3, 0x80000001, 0xc, 0x2, 0x4482, 0xffffffffffffffff, 0x2}}, 0xa0) r5 = syz_open_dev$vbi(&(0x7f0000000300), 0x0, 0x2) ioctl$VIDIOC_OVERLAY(r5, 0x4004560e, &(0x7f0000000340)=0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r6, 0x8b2a, &(0x7f0000000040)) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_DELDEST(r7, 0x0, 0x488, &(0x7f0000000280)={{0x2c, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x4, 'nq\x00', 0x12, 0xffffff01, 0x65}, {@dev={0xac, 0x14, 0x14, 0x35}, 0x4e21, 0x2000, 0x0, 0x7ff, 0x7f}}, 0x44) executing program 7: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f00000006c0), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000100)={0x33, 0x3, 0x1, "bc3e098e0000f4ba89591da86b97000000002b00030400", 0x32525942}) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x340, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x20000000, 0x20000000, 0x3, 0x7, 0x0, 0x40}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) (async) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000008000000000000001000000940000000fad413ec50000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r2}, 0x10) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000010850024ca83d70361c3e8000022000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010700000000000000000008000000b70300000000000085000000720000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000002400)={0x30, r5, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_WANTED={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}]}, 0x30}}, 0x0) (async) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) (async) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001c80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010000000000000000000200000008000100", @ANYRES32=r8], 0x1c}}, 0x0) (async) write$nci(r7, &(0x7f0000000300)=ANY=[@ANYBLOB="61050616050156f8b10d855d0cd6ae668a570b2657b8ca"], 0x17) (async) r11 = memfd_create(&(0x7f0000000180)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) r12 = memfd_create(&(0x7f0000000300)='-B\xd5N\b\x84\xa2m\x00\v\x18\xfb\x91hMy\xdb\xd1\xa7\xb1S\xf1:)\x00\xda\xf2\xb6\x16\xad\xed\x84\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9c:\x10d\xee\xa9\xcb\x06k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\xcc\x86\xfe2E-\x16 \xc8\x95\xc1\xe0aM\x9b\x9f\xf5\xab~\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\xfb\xbc\xea\xe7\x99\xdcrE\xba\xb2\xf4\xd0\x9b\xdaH\x8d\xb6\x01\xc8\xb6\xbd', 0x4) (async) r13 = dup(r11) copy_file_range(r12, 0x0, r13, 0x0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) (async) r14 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r15 = openat$full(0xffffffffffffff9c, &(0x7f0000000340), 0x101, 0x0) pwritev(r15, &(0x7f0000001300)=[{&(0x7f0000001040)='4', 0x1}], 0x1, 0x0, 0x0) (async) ioctl$KVM_CAP_DISABLE_QUIRKS(r14, 0x4068aea3, &(0x7f00000001c0)={0x74, 0x0, 0x12}) (async) r16 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') pread64(r16, &(0x7f0000004180)=""/4096, 0x1000, 0x18) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) (async) r2 = socket(0x1000000000000010, 0x80802, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000200000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36b26fb0b71d0e6adfefcf1d8f7faf75e0f226bd99eea7960717142fa9ea4318123741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ce99fbfbf9b0a4def23d410f6296b32a334388107200759cda9036b4e369a9e152ddcc7f05a5f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967deabe802f5ab3e89bd6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837074e098ee207d2f73902fbcfcf49822775985bf32d715f5888b24efa000000000000ffffffdf000000000000000000000089a7b9b00000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f91a31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5dff5adbdee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf1128744bab6677fcb78e313841ec309baed0495f06d058a75fa4c81e5c9f42d9383e41d277b10392a912ffaf6f658f3fadd16286744f839c3f128f8f92d0992239eafce5c1b3f97a297c9e49a0c3510ef74080e6d1e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda154910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b61799257ab55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bc6cf8809c3a0d46ff7f008000000000ad1e1f493354b2822b98371d000000167d78e65b90eba0768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cd1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e3344b155cc20f49e298727340e97cdefb40e56e9cfad973347d0de7ba4754ff231a1b033d8f931ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef79b8d4c2ff030000000000000007b82e6044f643068cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c99220002af8c5e53d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf99000000000000000000bfb32c826563c518d0ad23bc83ba3f3757210a057eff7615c868bd7d74233da1a3b56d4e04a7ec4792b1c4cffddbbdcfdd23ab5268f1b3d08ebb8ce498cbaaf5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fc02b70be8629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa44966945d93c33b038ce0d890f851811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f20a95b817ea3df3d6c0002a41783058e56c70afe8016b3dd9dc7785b36e609f173cc6b893ecd138289709839747837d6a6283b3452c57a5d44cacd363589845637071320921d22c1663964eddec902fc7cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c898b7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dca9c42c4d719347f39ef006c2df747ee6adb7cd04faf05c36de72354c64ebaf28a3de18607ebc4b70f50f71dae565749568a23319232dc213342fb472e98c9a412199ce7976bee5eaf40e60cb3fbe8b92dae5008e92d17d05ce74ffffe74ae71d5b8bd43a4e0bf0390335aa489689f5e3a4ac5adca96caab658b43cd499d95d3876c220d147ad1d0e626621d88f1370982f663793cac52ea0d14e595ff1f56427a0a813bb3b84d31d021eeea8faeff25bb66f5940d08a5509a66fc43962bcb2f7415bc38e355e80ec935aa6fe2d74bd475d89449fb46320fee40faff2fd005549fe6a042bd95decfde5e166971935f4cfd9c9e5bfd2d803644f4e5b7e6dc1a7a35df7134e2fad79269bf24bea4eb0213068e3054d9e4a8d1a9eb032cb390e2016d0ce10549728cb4732dc5adab16fa19ac70780b29e079be27c95d3dd2bd91a584c46d84d430fc6ea31ce0ba62fa27be9f6bc435203da7c3a5d68bf4dd4f81cbfaa1c87a15b9272853c9837db930952dca667194b71815a9eb49b495360dcdf31e0e560857d0541a916d6b5469ac1b36babc5a91e1d58925f20d9d5f8a0da3c30711b0d101cabceffbe072be69613ea0003c6e9bb5cd2413c8ddc17cfa319cf7aaeed0ffb07a08f8fb439f709dfe0732fe42192819870bdd87d5f612ade03540a28be446095269d9ea5a60bba1f2462f9921f2a731dbcf1d03964ea1e4f79514914d37877f57617b60fa2b58aa694fcb023024653c4b73efb12a57ffc6f8943262b77be933051e12bd4d768a422ea652d45b04a9c43b5c97fc3edea7002d51a0a74889334ee"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x29, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x24, r5, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008800}, 0x40000) ioperm(0x0, 0x8, 0x400000000000008) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) ioctl$CDROM_LAST_WRITTEN(0xffffffffffffffff, 0x5395, &(0x7f00000001c0)) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xd}}, './file0\x00'}) mount(&(0x7f0000000080)=@md0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000180)='smb3\x00', 0x208001, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000180)=0x3) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) (async) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x18, 0x68, 0x5fb9a818fb7378e9}, 0x18}}, 0x40) (async) r8 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x507983, 0x0) ioctl$VIDIOC_G_FREQUENCY(r8, 0xc02c5638, &(0x7f0000000100)={0x8, 0x4, 0x8000008}) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r8, 0x6, 0x1d, &(0x7f0000000300)={0x5, 0x10001, 0x5, 0x200000, 0x10001}, 0x14) (async) write$tun(r8, &(0x7f00000006c0)={@val={0x0, 0x9}, @void, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x3, @link_local, @ipv4={'\x00', '\xff\xff', @local}, @empty, @dev={0xfe, 0x80, '\x00', 0x21}}}, 0x38) executing program 0: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x800001, &(0x7f0000000100)=ANY=[@ANYRES8=0x0, @ANYRES16]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f0000005380)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9a7e5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c64e2645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734b5ecaf5e82983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1b8abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fa421a39943513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b70fa8eae6fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fda8bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f1cb390aaf82b0bc6af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff19427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c94c114d3c4c35eed4d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a65247317882fbf171520f00b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5d18f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077bec885ce88d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc670ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f9", 0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x7, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x80000000000, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, r1, r2, 0x0, 0x80000}}}, 0x0, 0x0, 0x0, 0x0}) symlink(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000180)='./file0/file0\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1b, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="180004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10010, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = open(0x0, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) unshare(0x8000400) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') poll(&(0x7f0000000200), 0x0, 0x1) finit_module(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES64=r5, @ANYBLOB="1e636fd0a19f1beb79685ba0e8f66a5fcbf50fd2d46e061c1db42518952e5a20", @ANYBLOB, @ANYBLOB="c3ee39a864b6c772dd754ca77fbc86e8b7a5e7ed703f06f09e6a5505c1f63b79153f5c1fa677425f8becfc8b7c829ddf47fcd2c756d653873059a0eb2d126767ed86b69b6e8708afbf730555a7886ab1aaa21fea9305ed4966764397feacff72c35492153b8b73a972e6160286dba3b92dcf952c983bb9a9221048f5454e2e871f54b34220e94f559022582e3d5e68eec1d5e9cbb9f3307443a147d393e84e99f4cc2524cfa13540bbeaec32fde056caf6c7b032b3794e0957", @ANYBLOB='\x00'/16, @ANYRES64=r2], 0x48) signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) r7 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r7, 0x4161, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x189841, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000040)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32=r0], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x6) executing program 7: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r1, r0, 0x5, 0x0, 0x0, @void, @value}, 0x10) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r1}, &(0x7f0000000040), &(0x7f0000000180)=r0}, 0x20) clock_adjtime(0x7, &(0x7f0000000200)={0x6, 0x6, 0x3101, 0xffffffffffff5f20, 0x6, 0x10, 0x10000, 0xf83, 0x8000000000, 0x8, 0x6, 0xffffffffffffffe0, 0x5, 0x14, 0xfffffffffffffffe, 0x3, 0x3, 0x7f, 0x2, 0x46, 0x5, 0x966, 0x7, 0x5, 0x3, 0x10001}) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x0, 0x54001) ioctl$MON_IOCX_GETX(r2, 0x4018920a, &(0x7f0000000600)={&(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000540)=""/137, 0x89}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x34, r5, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x0]}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x34}}, 0x0) r6 = syz_open_dev$video(&(0x7f00000000c0), 0x7, 0x80040) ioctl$VIDIOC_CROPCAP(r6, 0xc02c563a, &(0x7f0000000800)={0x9, {}, {0x0, 0x0, 0x2}, {0xfffffffc}}) sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="02000000", @ANYRES16=r5, @ANYBLOB="080029bd7000ffdbdf2502000000100004000200000004000000000000000500060000000000080002000002000004000400050006000a00000008000300000400000500050002000000"], 0x50}}, 0x40) executing program 6: r0 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x40502) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) close(0x3) r2 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0xc8d03) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000140)) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r2, 0xc03064ca, &(0x7f00000000c0)={&(0x7f0000000040)=[r1, r1], 0x0, 0xa00000000000, 0x2, 0x6}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000140)=[r1], 0x0, 0x1}) lsm_list_modules(&(0x7f0000002600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000000)=0x7b, 0x0) executing program 0: r0 = inotify_init() readv(r0, &(0x7f0000000440)=[{&(0x7f0000000280)=""/174, 0xae}], 0x1) inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x400017e) creat(&(0x7f0000000040)='./file0/file0\x00', 0x24) executing program 6: r0 = socket(0x23, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x80000001, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x8000000, 0x8f96}], '\x00', 0x1000}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000008c0)=ANY=[@ANYBLOB="1c0000f5000000000000000000e1ff00000002"], 0x73) executing program 7: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x71}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) lchown(&(0x7f0000000000)='./file0\x00', 0xee00, r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000f00)=ANY=[@ANYBLOB="8500000008000000350000000000000085000000050000009500000000000000fed023000000c71adb30be7d75fa1f32f08a23ce3220b0cc9505d72768b8242dd90d17e4c52505756ca2b009546a0900000000000000d3df2bd87184446d165ae3939bbca322a415a98c8801000000000000800859362ed862b3c47f82000000adfd2f16af3a00000000000000000000009a317aa34f0c50f99eedac26048ab915e1be5aa845be00de14683ee4e859d65564a9c79d20e5a011e966388cd0bb39f45d6c508b8a0f7f2d48be0e2a8137c6741775428abf2ddfd2a473f5b271701e22f8cb42198906e1107fa780c435083cac323838727afbfb995f99b82df3b363a9cf6ba87fdfbf5a3dd0dde49b4193520e5e946687634c04000000000000bfbcd911eba0dee5e5ce6434f86fe82ee02f0e8e3173a97d85e232e584ace13387693614f3a74dc418e58f3e98933b2c93fae25ec2dd190231e2531e1ffeff33676a4383a918cba3ad8318ea29f164563a42cdb596f255a251add2d2ae2fac0a0e7421e4bf07fc884be5721bdffe58c6a4b57014ce976ce8b9cddfa50175c53253d7659f0e88913d4fa7f309eb40337fada4363c0698510730725e23bdad60ceaeecfeeccc397565f204b82d000000007a1b4abeadf350c21027d314237a9d448b82827ff3f29cc9b46c8fcfbb30d1fc38311f0918707c252b596cdbf4e77836adc1f59f9d1280333d135fdcdcee8eb817388666e02ff1b148b6bc3c283e71c0ad9c683c6bb6fea2d2d54af3ad488f0cc2e54a70c19ceac518adbe917652c34019d7478c716ab23d4a863b4dcd08d89f6cec674e9fd379d71e06357d207984e885ace8a0dbaffef403aff01d5f2f0e644b61cd8bd72a59f2d7cf67815aeb8761412d68c40dbed08b7eeda96b3856a519a71b83c19b2e8f88d92b66abec165663819a87e7cd8c082cb011051789c283eecfe08f0799f6c7023353b6d3af7177d6b5420b1784b53238b39c0db1da864e593d45fd297e4d34e749bc737e0bcf36fd955a40124c00d40c3f21d26e6e276152412b4ef3f52dc416bb2d7463a93ee6c0b20c5749a44677a3c3a7aa9a47c7cd7bb52fbb2c8d63166f4ad1038f33258736b2224a66726f1fd4dce0eb6043a55fbdd341baba95cc5838a860068e0f3e73d992403455b03b25bd5414628d7325a6b25986666b3368210686dab3a6be8b8d4bd9347c83cb693aebab072fe479705b0c6c9bb9728d131f8320b966898de1a16407692b57b6f7333eac0d2ed0a7a4457d9c70089fcf9aa553929a65777f3bbf6d0bdc6a11371a138c6d4b0fefc655716e4486f5c7a88e80b2fb0efb579333bef98ded75abfb982b1fb92f003a6aefb8bf25eacb848d8ed1c1162d000000000000000000000000e87dffd60f123527781805434d210bb72ac2c097c45b27dde4980bc85b43614d266a9d403c320f80646c7df8bdd1cf3800"/1071], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/148, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff79, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x16) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0x0, 0x83, 0x0, &(0x7f0000000e40)="04d31fcd275bfc58188e699fa7c9aa904991771e83b702f3717cf38ed0e92e83ae490758991fa1174a75fa8c45db732026d3de611ffbd09b683e2f08812d695dd9b87f08711c02bb5d2cbac05022bee8aee5339fb6eba21e534e43b9960f470bf9c075368c6a7ee0b6ef641feb6967490ae07547819adcf47330679551ae2bd7009b31", 0x0, 0x947, 0x0, 0x1b, 0x4b, &(0x7f0000000000), &(0x7f0000000e00)="2fda8e7aa8d9cecae13bcbb35230d1cf1f1b23e33fcbd1aa1bea454b04650cecef80daa9a0a349a8e46d661af6e7ee8cdb5e97e738fe54"}, 0x50) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x150) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x4010ae68, &(0x7f0000000040)={0x5000, 0x0, 0x1}) executing program 7: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1a00fe00000000bfa100007b0a000007010000f8ff6fffb702000008000000b70300000000000085000000c700000095"], &(0x7f0000000040)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x1000000, &(0x7f0000000600)={[{@mode={'mode', 0x3d, 0x10000}}]}) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') r1 = open(&(0x7f0000000a40)='./bus\x00', 0x141a42, 0x0) sendfile(r1, r0, 0x0, 0x100801700) syz_open_dev$video(&(0x7f0000000000), 0x7fff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet6(0xa, 0x4, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(r6, 0x40044160, 0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000080)=[{0x9, 0xd, 0x0, 0x7fffffff}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0xc102, 0x0) sendfile(r7, r7, 0x0, 0x40008) r8 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e60, 0x0, @loopback}, 0x1a) listen(r8, 0xa) r9 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r9, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) executing program 6: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch single: successfully extracted reproducer found reproducer with 12 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash reproducing took 48m10.793056942s repro crashed as (corrupted=false): BUG: Bad page state in process syz.1.66 pfn:29368 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29368 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123879345, free_ts 126833605133 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:3108f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803108fc98 pfn:0x3108f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88803108fc98 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123874685, free_ts 126833608969 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2968b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802968b000 pfn:0x2968b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802968b000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123870314, free_ts 126833612599 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35ea9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035ea9f00 pfn:0x35ea9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035ea9f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123865922, free_ts 126833616569 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:292b3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x292b3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123861437, free_ts 126833620356 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35d49 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035d492d0 pfn:0x35d49 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035d492d0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123856734, free_ts 126833624291 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31665 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031665100 pfn:0x31665 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031665100 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123852332, free_ts 126833627942 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:312d0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880312d0f00 pfn:0x312d0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880312d0f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123847550, free_ts 126833632484 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:321a0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880321a0798 pfn:0x321a0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880321a0798 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123842930, free_ts 126833636506 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:20b84 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020b84e58 pfn:0x20b84 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888020b84e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123838462, free_ts 126833640122 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:32566 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032566f00 pfn:0x32566 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888032566f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123833901, free_ts 126833643884 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4030e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804030ee88 pfn:0x4030e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804030ee88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123829132, free_ts 126833648025 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4e026 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e026400 pfn:0x4e026 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804e026400 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123824688, free_ts 126833651819 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:28352 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028352c00 pfn:0x28352 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888028352c00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123820224, free_ts 126833655781 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4a34d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804a34d000 pfn:0x4a34d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804a34d000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123815374, free_ts 126833659711 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2fb76 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802fb76000 pfn:0x2fb76 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802fb76000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123810985, free_ts 126833663760 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:24444 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888024444d90 pfn:0x24444 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888024444d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123806601, free_ts 126833669963 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35e64 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035e64000 pfn:0x35e64 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035e64000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123801983, free_ts 126833673950 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2879d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802879dca8 pfn:0x2879d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802879dca8 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123797667, free_ts 126833694883 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31323 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031323d80 pfn:0x31323 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031323d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123793217, free_ts 126833698783 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:491d7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625d0e3 pfn:0x491d7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625d0e3 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123788780, free_ts 126833703167 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:314fa page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880314faf50 pfn:0x314fa flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880314faf50 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123784315, free_ts 126833707405 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27255 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27255 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123779733, free_ts 126833711233 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:315b4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880315b4000 pfn:0x315b4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880315b4000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123775303, free_ts 126833715151 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31d91 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031d91e58 pfn:0x31d91 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031d91e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123770850, free_ts 126833718844 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2f9ab page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f9abf00 pfn:0x2f9ab flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802f9abf00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123766426, free_ts 126833723210 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27fea page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027fea1e0 pfn:0x27fea flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027fea1e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123761316, free_ts 126833726911 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:3b271 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b271000 pfn:0x3b271 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88803b271000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123756878, free_ts 126833731261 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:490e2 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625cfee pfn:0x490e2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625cfee 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123752403, free_ts 126833736618 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:32a7c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032a7cd90 pfn:0x32a7c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888032a7cd90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123747751, free_ts 126833754906 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4cf01 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4cf01 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123743327, free_ts 126833759860 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4034d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804034d000 pfn:0x4034d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804034d000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123738877, free_ts 126833763837 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2849b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2849b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123734262, free_ts 126833767623 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31189 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31189 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123729738, free_ts 126833771430 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31dae page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031daee88 pfn:0x31dae flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031daee88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123725223, free_ts 126833775410 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4d685 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d685e88 pfn:0x4d685 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804d685e88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123720285, free_ts 126833790665 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4db2b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804db2bd90 pfn:0x4db2b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804db2bd90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123715514, free_ts 126833794612 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:205cb page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880205cbf00 pfn:0x205cb flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880205cbf00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123697993, free_ts 126833816701 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27d98 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027d98f00 pfn:0x27d98 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027d98f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123693219, free_ts 126833821632 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:315bd page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880315bd000 pfn:0x315bd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880315bd000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123688680, free_ts 126833841660 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4e03c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e03ce58 pfn:0x4e03c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804e03ce58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123684283, free_ts 126833847670 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2913b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802913b000 pfn:0x2913b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802913b000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123679613, free_ts 126888303226 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27573 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027573d90 pfn:0x27573 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027573d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123674783, free_ts 126888308501 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2efc7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802efc73c0 pfn:0x2efc7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802efc73c0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123669627, free_ts 126888313833 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2ad73 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802ad73e88 pfn:0x2ad73 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802ad73e88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123665080, free_ts 126888318929 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:254ae page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880254aed90 pfn:0x254ae flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880254aed90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123660673, free_ts 126888324413 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:48f16 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625ce22 pfn:0x48f16 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625ce22 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123656152, free_ts 126888330078 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:259e4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880259e40f0 pfn:0x259e4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880259e40f0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123651458, free_ts 126890520488 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 bpf_prog_calc_tag+0x539/0x720 kernel/bpf/core.c:358 resolve_pseudo_ldimm64+0xcd/0x2950 kernel/bpf/verifier.c:18992 bpf_check+0x6e0f/0xb430 kernel/bpf/verifier.c:22407 bpf_prog_load+0xedb/0x2660 kernel/bpf/syscall.c:2846 __sys_bpf+0x402b/0x49a0 kernel/bpf/syscall.c:5653 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2f024 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f024e58 pfn:0x2f024 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802f024e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123646977, free_ts 126890595257 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 bpf_check+0x1b2b/0xb430 kernel/bpf/verifier.c:22556 bpf_prog_load+0xedb/0x2660 kernel/bpf/syscall.c:2846 __sys_bpf+0x402b/0x49a0 kernel/bpf/syscall.c:5653 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:298ea page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880298eaca8 pfn:0x298ea flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880298eaca8 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123642347, free_ts 126901686523 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2fdb5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802fdb5e58 pfn:0x2fdb5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802fdb5e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123637643, free_ts 126901700539 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2d818 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d818690 pfn:0x2d818 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802d818690 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123633028, free_ts 126901710214 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 final repro crashed as (corrupted=false): BUG: Bad page state in process syz.1.66 pfn:29368 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29368 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123879345, free_ts 126833605133 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:3108f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803108fc98 pfn:0x3108f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88803108fc98 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123874685, free_ts 126833608969 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2968b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802968b000 pfn:0x2968b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802968b000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123870314, free_ts 126833612599 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35ea9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035ea9f00 pfn:0x35ea9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035ea9f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123865922, free_ts 126833616569 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:292b3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x292b3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123861437, free_ts 126833620356 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35d49 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035d492d0 pfn:0x35d49 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035d492d0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123856734, free_ts 126833624291 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31665 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031665100 pfn:0x31665 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031665100 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123852332, free_ts 126833627942 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:312d0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880312d0f00 pfn:0x312d0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880312d0f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123847550, free_ts 126833632484 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:321a0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880321a0798 pfn:0x321a0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880321a0798 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123842930, free_ts 126833636506 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:20b84 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020b84e58 pfn:0x20b84 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888020b84e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123838462, free_ts 126833640122 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:32566 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032566f00 pfn:0x32566 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888032566f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123833901, free_ts 126833643884 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4030e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804030ee88 pfn:0x4030e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804030ee88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123829132, free_ts 126833648025 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4e026 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e026400 pfn:0x4e026 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804e026400 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123824688, free_ts 126833651819 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:28352 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028352c00 pfn:0x28352 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888028352c00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123820224, free_ts 126833655781 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4a34d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804a34d000 pfn:0x4a34d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804a34d000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123815374, free_ts 126833659711 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2fb76 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802fb76000 pfn:0x2fb76 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802fb76000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123810985, free_ts 126833663760 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:24444 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888024444d90 pfn:0x24444 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888024444d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123806601, free_ts 126833669963 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:35e64 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035e64000 pfn:0x35e64 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888035e64000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123801983, free_ts 126833673950 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2879d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802879dca8 pfn:0x2879d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802879dca8 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123797667, free_ts 126833694883 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31323 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031323d80 pfn:0x31323 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031323d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123793217, free_ts 126833698783 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:491d7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625d0e3 pfn:0x491d7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625d0e3 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123788780, free_ts 126833703167 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:314fa page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880314faf50 pfn:0x314fa flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880314faf50 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123784315, free_ts 126833707405 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27255 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27255 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123779733, free_ts 126833711233 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:315b4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880315b4000 pfn:0x315b4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880315b4000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123775303, free_ts 126833715151 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31d91 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031d91e58 pfn:0x31d91 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031d91e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123770850, free_ts 126833718844 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2f9ab page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f9abf00 pfn:0x2f9ab flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802f9abf00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123766426, free_ts 126833723210 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27fea page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027fea1e0 pfn:0x27fea flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027fea1e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123761316, free_ts 126833726911 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:3b271 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b271000 pfn:0x3b271 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88803b271000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123756878, free_ts 126833731261 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:490e2 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625cfee pfn:0x490e2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625cfee 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123752403, free_ts 126833736618 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:32a7c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032a7cd90 pfn:0x32a7c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888032a7cd90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123747751, free_ts 126833754906 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4cf01 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x4cf01 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123743327, free_ts 126833759860 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4034d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804034d000 pfn:0x4034d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804034d000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123738877, free_ts 126833763837 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2849b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2849b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123734262, free_ts 126833767623 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31189 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31189 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123729738, free_ts 126833771430 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:31dae page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031daee88 pfn:0x31dae flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888031daee88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123725223, free_ts 126833775410 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4d685 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804d685e88 pfn:0x4d685 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804d685e88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123720285, free_ts 126833790665 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4db2b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804db2bd90 pfn:0x4db2b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804db2bd90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123715514, free_ts 126833794612 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:205cb page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880205cbf00 pfn:0x205cb flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880205cbf00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123697993, free_ts 126833816701 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27d98 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027d98f00 pfn:0x27d98 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027d98f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123693219, free_ts 126833821632 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:315bd page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880315bd000 pfn:0x315bd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880315bd000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123688680, free_ts 126833841660 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:4e03c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e03ce58 pfn:0x4e03c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88804e03ce58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123684283, free_ts 126833847670 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6281 tgid 6279 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2913b page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802913b000 pfn:0x2913b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802913b000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123679613, free_ts 126888303226 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:27573 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027573d90 pfn:0x27573 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff888027573d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123674783, free_ts 126888308501 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2efc7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802efc73c0 pfn:0x2efc7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802efc73c0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123669627, free_ts 126888313833 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2ad73 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802ad73e88 pfn:0x2ad73 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802ad73e88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123665080, free_ts 126888318929 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:254ae page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880254aed90 pfn:0x254ae flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880254aed90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123660673, free_ts 126888324413 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:48f16 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f625ce22 pfn:0x48f16 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: 00000007f625ce22 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123656152, free_ts 126888330078 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 htable_put net/netfilter/xt_hashlimit.c:424 [inline] hashlimit_mt_destroy+0x7e/0xa0 net/netfilter/xt_hashlimit.c:977 cleanup_match net/ipv6/netfilter/ip6_tables.c:477 [inline] cleanup_entry+0x19f/0x3a0 net/ipv6/netfilter/ip6_tables.c:661 translate_table+0xddd/0x17b0 net/ipv6/netfilter/ip6_tables.c:744 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline] do_ip6t_set_ctl+0x605/0xc40 net/ipv6/netfilter/ip6_tables.c:1644 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998 rawv6_setsockopt+0xd7/0x680 net/ipv6/raw.c:1054 do_sock_setsockopt+0x222/0x480 net/socket.c:2334 __sys_setsockopt+0x1a4/0x270 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2363 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:259e4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880259e40f0 pfn:0x259e4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880259e40f0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123651458, free_ts 126890520488 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 bpf_prog_calc_tag+0x539/0x720 kernel/bpf/core.c:358 resolve_pseudo_ldimm64+0xcd/0x2950 kernel/bpf/verifier.c:18992 bpf_check+0x6e0f/0xb430 kernel/bpf/verifier.c:22407 bpf_prog_load+0xedb/0x2660 kernel/bpf/syscall.c:2846 __sys_bpf+0x402b/0x49a0 kernel/bpf/syscall.c:5653 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2f024 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f024e58 pfn:0x2f024 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802f024e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123646977, free_ts 126890595257 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6291 tgid 6288 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 bpf_check+0x1b2b/0xb430 kernel/bpf/verifier.c:22556 bpf_prog_load+0xedb/0x2660 kernel/bpf/syscall.c:2846 __sys_bpf+0x402b/0x49a0 kernel/bpf/syscall.c:5653 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:298ea page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880298eaca8 pfn:0x298ea flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff8880298eaca8 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123642347, free_ts 126901686523 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2fdb5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802fdb5e58 pfn:0x2fdb5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802fdb5e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123637643, free_ts 126901700539 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd45b57e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd45c319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd45b736058 RCX: 00007fd45b57e719 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007fd45b5f132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd45b736058 R15: 00007ffd2e0c9fc8 BUG: Bad page state in process syz.1.66 pfn:2d818 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d818690 pfn:0x2d818 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff88804cdea000 0000000000000000 raw: ffff88802d818690 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6305, tgid 6299 (syz.1.66), ts 127123633028, free_ts 126901710214 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6285 tgid 6284 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 page_pool_return_page+0x400/0x520 net/core/page_pool.c:692 page_pool_empty_alloc_cache_once net/core/page_pool.c:1034 [inline] page_pool_scrub net/core/page_pool.c:1040 [inline] page_pool_release+0xf4/0x7d0 net/core/page_pool.c:1053 page_pool_destroy+0x10a/0x4c0 net/core/page_pool.c:1126 xdp_test_run_teardown net/bpf/test_run.c:218 [inline] bpf_test_run_xdp_live+0x3a1/0x500 net/bpf/test_run.c:395 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 3 UID: 0 PID: 6305 Comm: syz.1.66 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899