Extracting prog: 56.857644844s Minimizing prog: 23m9.37031651s Simplifying prog options: 0s Extracting C: 36.781186361s Simplifying C: 5m5.099425339s extracting reproducer from 52 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch single: successfully extracted reproducer found reproducer with 12 syscalls minimizing guilty program testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-socket$igmp6-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-sendmsg$inet-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socketpair$unix-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-recvmsg$unix-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program crashed: BUG: Bad page state in xdp_test_run_batch testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) program did not crash testing program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) program did not crash extracting C reproducer testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch simplifying C reproducer testing compiled C program (duration=55.507239216s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program did not crash testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program did not crash testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program did not crash testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch testing compiled C program (duration=55.507239216s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmsg$inet-socket$igmp6-setsockopt$IP6T_SO_SET_REPLACE-write$cgroup_subtree-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN program crashed: BUG: Bad page state in xdp_test_run_batch reproducing took 29m48.108600379s repro crashed as (corrupted=false): BUG: Bad page state in process syz-executor133 pfn:2b552 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b552070 pfn:0x2b552 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b552070 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468123609, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b551 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2b551 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468115730, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b550 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b554000 pfn:0x2b550 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b554000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468107301, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27cc1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x27cc1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468064016, free_ts 41221103219 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27cc0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027cc4000 pfn:0x27cc0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888027cc4000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468055933, free_ts 41930978742 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b273 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b273 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468047909, free_ts 43968266155 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b272 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b272 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468039689, free_ts 43968250819 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b271 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2b271 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468031766, free_ts 43968259824 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b270 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b276600 pfn:0x2b270 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b276600 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468023791, free_ts 43968304053 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468014991, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d6 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d6 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468006977, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467998745, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467990549, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc07 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc07 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467982476, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc06 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc06 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467974433, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc05 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc05 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467966403, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc04 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc04 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467955330, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34223 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34223 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467947287, free_ts 35628127148 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34222 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034222d80 pfn:0x34222 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888034222d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467938967, free_ts 35628116372 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34221 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000004 pfn:0x34221 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888000000004 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467931268, free_ts 35628109601 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34220 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034223c00 pfn:0x34220 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888034223c00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467923661, free_ts 35628123592 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x28ba7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467915630, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba6 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba7180 pfn:0x28ba6 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba7180 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467907743, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba5f00 pfn:0x28ba5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba5f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467899242, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba43e0 pfn:0x28ba4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba43e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467866054, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467857620, free_ts 40827981238 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467849449, free_ts 40827996290 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467841265, free_ts 40828014567 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467832836, free_ts 40809395025 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23297 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23297 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467824539, free_ts 41423253861 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23296 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23296 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467815962, free_ts 41892304988 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2eefe page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802eefe000 pfn:0x2eefe flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802eefe000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467807775, free_ts 40198022367 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:229fa page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880229fbe00 pfn:0x229fa flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880229fbe00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467798364, free_ts 40198026417 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27558 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880275589a0 pfn:0x27558 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880275589a0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467730035, free_ts 40198030818 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:31c13 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031c13d80 pfn:0x31c13 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888031c13d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467721548, free_ts 40198040120 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30ef7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x30ef7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467713391, free_ts 40198044337 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:1f810 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801f810e58 pfn:0x1f810 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88801f810e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467705064, free_ts 40198048755 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:31805 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31805 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467695863, free_ts 40198053598 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:121dd page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121dd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467679035, free_ts 40579523494 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30c5d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fe2 pfn:0x30c5d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fe2 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467670394, free_ts 40579534854 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30e59 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fec pfn:0x30e59 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fec 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467661725, free_ts 40579540165 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:29302 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3feb pfn:0x29302 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003feb 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467653111, free_ts 40579562449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23430 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fe9 pfn:0x23430 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fe9 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467645396, free_ts 40579568608 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:3317a page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3317a flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467637230, free_ts 40579573334 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:36025 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36025 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467628811, free_ts 40579577652 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:238a3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880238a3500 pfn:0x238a3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880238a3500 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467620340, free_ts 40579588313 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23611 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x23611 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467613234, free_ts 40579593387 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:258b9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x258b9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467605317, free_ts 40579597638 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:20400 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020400d90 pfn:0x20400 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888020400d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467596800, free_ts 40579602376 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2be6d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802be6de88 pfn:0x2be6d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802be6de88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467588685, free_ts 40579612536 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:29006 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029007680 pfn:0x29006 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888029007680 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467581360, free_ts 44458687275 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2d5bf page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d5bf flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467573941, free_ts 44458699436 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2505c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802505c000 pfn:0x2505c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802505c000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467565267, free_ts 44458706336 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2a14e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a14e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467556986, free_ts 44458713193 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27f55 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x27f55 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000004 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467548425, free_ts 44458719755 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:341af page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x341af flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467541533, free_ts 44458725924 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2a5b5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a5b5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467534783, free_ts 44458731847 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:300b0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880300b6600 pfn:0x300b0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880300b6600 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467528326, free_ts 44458737521 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:300b4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x300b4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467521114, free_ts 44458744053 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:3417d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803417d330 pfn:0x3417d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 final repro crashed as (corrupted=false): BUG: Bad page state in process syz-executor133 pfn:2b552 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b552070 pfn:0x2b552 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b552070 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468123609, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Not tainted 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b551 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2b551 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468115730, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b550 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b554000 pfn:0x2b550 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b554000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468107301, free_ts 44138879272 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 29 tgid 29 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x4d7/0x730 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] napi_consume_skb+0x15a/0x220 net/core/skbuff.c:1518 skb_defer_free_flush net/core/dev.c:6317 [inline] skb_defer_free_flush net/core/dev.c:6301 [inline] net_rx_action+0x47c/0x1010 net/core/dev.c:6947 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:927 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27cc1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x27cc1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468064016, free_ts 41221103219 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27cc0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027cc4000 pfn:0x27cc0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888027cc4000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468055933, free_ts 41930978742 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b273 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b273 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468047909, free_ts 43968266155 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b272 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b272 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468039689, free_ts 43968250819 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b271 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2b271 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468031766, free_ts 43968259824 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2b270 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b276600 pfn:0x2b270 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802b276600 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468023791, free_ts 43968304053 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5932 tgid 5932 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468014991, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d6 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d6 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44468006977, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467998745, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:309d4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x309d4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467990549, free_ts 28536726972 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5829 tgid 5829 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc07 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc07 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467982476, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc06 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc06 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467974433, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc05 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc05 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467966403, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2fc04 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fc04 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467955330, free_ts 35470365449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5658 tgid 5658 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 stack_depot_save_flags+0x2da/0x8f0 lib/stackdepot.c:666 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x211/0x430 mm/slub.c:4270 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:658 fib_create_info+0x4ab/0x4d10 net/ipv4/fib_semantics.c:1447 fib_table_insert+0x1d7/0x1d70 net/ipv4/fib_trie.c:1237 fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x422/0x560 net/ipv4/fib_frontend.c:1133 fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 blocking_notifier_call_chain kernel/notifier.c:388 [inline] blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:376 __inet_insert_ifa+0x93f/0xc30 net/ipv4/devinet.c:586 inet_rtm_newaddr+0x565/0xae0 net/ipv4/devinet.c:997 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34223 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34223 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467947287, free_ts 35628127148 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34222 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034222d80 pfn:0x34222 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888034222d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467938967, free_ts 35628116372 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34221 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000004 pfn:0x34221 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888000000004 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467931268, free_ts 35628109601 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:34220 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034223c00 pfn:0x34220 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888034223c00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467923661, free_ts 35628123592 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0x28ba7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000002 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467915630, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba6 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba7180 pfn:0x28ba6 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba7180 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467907743, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba5f00 pfn:0x28ba5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba5f00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467899242, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:28ba4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028ba43e0 pfn:0x28ba4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888028ba43e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467866054, free_ts 35584189006 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5873 tgid 5873 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname+0x8d/0xe0 fs/namei.c:225 do_sys_openat2+0x104/0x1e0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467857620, free_ts 40827981238 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467849449, free_ts 40827996290 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467841265, free_ts 40828014567 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2464c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2464c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467832836, free_ts 40809395025 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23297 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23297 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467824539, free_ts 41423253861 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23296 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23296 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467815962, free_ts 41892304988 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2eefe page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802eefe000 pfn:0x2eefe flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802eefe000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467807775, free_ts 40198022367 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:229fa page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880229fbe00 pfn:0x229fa flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880229fbe00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467798364, free_ts 40198026417 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27558 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880275589a0 pfn:0x27558 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880275589a0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467730035, free_ts 40198030818 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:31c13 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031c13d80 pfn:0x31c13 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888031c13d80 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467721548, free_ts 40198040120 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30ef7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x30ef7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467713391, free_ts 40198044337 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:1f810 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801f810e58 pfn:0x1f810 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88801f810e58 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467705064, free_ts 40198048755 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:31805 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31805 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467695863, free_ts 40198053598 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:121dd page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121dd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467679035, free_ts 40579523494 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30c5d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fe2 pfn:0x30c5d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fe2 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467670394, free_ts 40579534854 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:30e59 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fec pfn:0x30e59 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fec 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467661725, free_ts 40579540165 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:29302 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3feb pfn:0x29302 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003feb 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467653111, free_ts 40579562449 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23430 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x3fe9 pfn:0x23430 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000003fe9 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467645396, free_ts 40579568608 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:3317a page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3317a flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467637230, free_ts 40579573334 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:36025 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36025 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467628811, free_ts 40579577652 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:238a3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880238a3500 pfn:0x238a3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880238a3500 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467620340, free_ts 40579588313 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:23611 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x23611 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467613234, free_ts 40579593387 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:258b9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x258b9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467605317, free_ts 40579597638 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:20400 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020400d90 pfn:0x20400 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888020400d90 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467596800, free_ts 40579602376 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2be6d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802be6de88 pfn:0x2be6d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802be6de88 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467588685, free_ts 40579612536 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5924 tgid 5924 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] put_page+0x21e/0x280 include/linux/mm.h:1550 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:488 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:569 ksys_read+0x1fa/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:29006 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029007680 pfn:0x29006 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff888029007680 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467581360, free_ts 44458687275 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2d5bf page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d5bf flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467573941, free_ts 44458699436 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2505c page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802505c000 pfn:0x2505c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff88802505c000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467565267, free_ts 44458706336 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2a14e page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a14e flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467556986, free_ts 44458713193 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:27f55 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x27f55 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000004 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467548425, free_ts 44458719755 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:341af page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x341af flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467541533, free_ts 44458725924 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:2a5b5 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a5b5 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467534783, free_ts 44458731847 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:300b0 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880300b6600 pfn:0x300b0 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: ffff8880300b6600 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467528326, free_ts 44458737521 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:300b4 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x300b4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5946, tgid 5942 (syz-executor133), ts 44467521114, free_ts 44458744053 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x101e/0x3070 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_bulk_noprof+0x77c/0x1110 mm/page_alloc.c:4681 alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline] __page_pool_alloc_pages_slow+0x18f/0x770 net/core/page_pool.c:538 page_pool_alloc_netmem net/core/page_pool.c:590 [inline] page_pool_alloc_netmem+0xc4/0x160 net/core/page_pool.c:577 page_pool_alloc_pages+0x1a/0x60 net/core/page_pool.c:597 page_pool_dev_alloc_pages include/net/page_pool/helpers.h:96 [inline] xdp_test_run_batch.constprop.0+0x3a8/0x1960 net/bpf/test_run.c:305 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 40 tgid 40 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __folio_put+0x30d/0x3d0 mm/swap.c:126 folio_put include/linux/mm.h:1478 [inline] free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0xa4/0xc0 arch/x86/kernel/smp.c:266 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709 Modules linked in: CPU: 0 UID: 0 PID: 5946 Comm: syz-executor133 Tainted: G B 6.12.0-rc5-syzkaller-00005-ge42b1a9a2557 #0 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 bad_page+0xb3/0x1f0 mm/page_alloc.c:501 free_page_is_bad_report mm/page_alloc.c:908 [inline] free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0x657/0xdc0 mm/page_alloc.c:2638 skb_free_frag include/linux/skbuff.h:3399 [inline] skb_free_head+0xa0/0x1d0 net/core/skbuff.c:1096 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1262 [inline] __netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5640 __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5741 __netif_receive_skb_list net/core/dev.c:5808 [inline] netif_receive_skb_list_internal+0x753/0xdb0 net/core/dev.c:5899 netif_receive_skb_list+0x4f/0x4a0 net/core/dev.c:5951 xdp_recv_frames net/bpf/test_run.c:279 [inline] xdp_test_run_batch.constprop.0+0x138d/0x1960 net/bpf/test_run.c:360 bpf_test_run_xdp_live+0x365/0x500 net/bpf/test_run.c:389 bpf_prog_test_run_xdp+0x827/0x1580 net/bpf/test_run.c:1317 bpf_prog_test_run kernel/bpf/syscall.c:4266 [inline] __sys_bpf+0xfc6/0x49a0 kernel/bpf/syscall.c:5671 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline] __se_sys_bpf kernel/bpf/syscall.c:5758 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5758 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5102b5de99 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5102b18228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f5102be8328 RCX: 00007f5102b5de99 RDX: 0000000000000048 RSI: 0000000020000600 RDI: 000000000000000a RBP: 00007f5102be8320 R08: 00007f5102b186c0 R09: 00007f5102b186c0 R10: 00007f5102b186c0 R11: 0000000000000246 R12: 00007f5102bb5074 R13: 0000000020000eb8 R14: 2caa1414ac000000 R15: 00007ffc619b1828 BUG: Bad page state in process syz-executor133 pfn:3417d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803417d330 pfn:0x3417d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff8880202ae000 0000000000000000