Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. 2026/03/23 13:23:10 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 110.439639][ T6139] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 113.316547][ T6160] chnl_net:caif_netlink_parms(): no params data found [ 113.399532][ T6160] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.406916][ T6160] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.414141][ T6160] bridge_slave_0: entered allmulticast mode [ 113.421162][ T6160] bridge_slave_0: entered promiscuous mode [ 113.430337][ T6160] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.437600][ T6160] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.445556][ T6160] bridge_slave_1: entered allmulticast mode [ 113.452453][ T6160] bridge_slave_1: entered promiscuous mode [ 113.479819][ T6160] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.491102][ T6160] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.521326][ T6160] team0: Port device team_slave_0 added [ 113.530365][ T6160] team0: Port device team_slave_1 added [ 113.553511][ T6160] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.560760][ T6160] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.587186][ T6160] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.599076][ T6160] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.606136][ T6160] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.632188][ T6160] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.672154][ T6160] hsr_slave_0: entered promiscuous mode [ 113.679052][ T6160] hsr_slave_1: entered promiscuous mode [ 114.170642][ T6160] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 114.185550][ T6160] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 114.197087][ T6160] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 114.208188][ T6160] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 114.243303][ T6160] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.250573][ T6160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.258080][ T6160] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.265272][ T6160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.314024][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.321632][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.366290][ T6160] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.388092][ T6160] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.416488][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.423769][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.439732][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.446998][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.697250][ T6160] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.748915][ T6160] veth0_vlan: entered promiscuous mode [ 114.762419][ T6160] veth1_vlan: entered promiscuous mode [ 114.801107][ T6160] veth0_macvtap: entered promiscuous mode [ 114.813304][ T6160] veth1_macvtap: entered promiscuous mode [ 114.837036][ T6160] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.854330][ T6160] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.871356][ T1159] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.902439][ T1159] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.933768][ T1159] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.942564][ T1159] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.085344][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.178512][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.262435][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.381209][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.159551][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.176617][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.204479][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.212414][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.352670][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 116.362375][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 116.370777][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 116.385528][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 116.395766][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 117.480526][ T13] bridge_slave_1: left allmulticast mode [ 117.497190][ T13] bridge_slave_1: left promiscuous mode [ 117.513356][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.568283][ T13] bridge_slave_0: left allmulticast mode [ 117.576338][ T13] bridge_slave_0: left promiscuous mode [ 117.582139][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.011264][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 118.024687][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 118.036988][ T13] bond0 (unregistering): Released all slaves [ 118.170957][ T13] hsr_slave_0: left promiscuous mode [ 118.184508][ T13] hsr_slave_1: left promiscuous mode [ 118.199344][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.210749][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 118.246070][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.272355][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 118.292334][ T13] veth1_macvtap: left promiscuous mode [ 118.310587][ T13] veth0_macvtap: left promiscuous mode [ 118.316659][ T13] veth1_vlan: left promiscuous mode [ 118.322209][ T13] veth0_vlan: left promiscuous mode [ 118.706780][ T13] team0 (unregistering): Port device team_slave_1 removed [ 118.721008][ T13] team0 (unregistering): Port device team_slave_0 removed 2026/03/23 13:23:24 executed programs: 0 [ 120.228552][ T5145] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 120.237481][ T5145] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 120.247490][ T5145] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 120.283266][ T5145] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 120.293116][ T5145] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 120.671468][ T6410] chnl_net:caif_netlink_parms(): no params data found [ 120.931980][ T6410] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.944311][ T6410] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.951714][ T6410] bridge_slave_0: entered allmulticast mode [ 120.960464][ T6410] bridge_slave_0: entered promiscuous mode [ 120.969221][ T6410] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.977105][ T6410] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.984681][ T6410] bridge_slave_1: entered allmulticast mode [ 120.994250][ T6410] bridge_slave_1: entered promiscuous mode [ 121.065446][ T6410] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 121.077662][ T6410] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 121.147658][ T6410] team0: Port device team_slave_0 added [ 121.156123][ T6410] team0: Port device team_slave_1 added [ 121.197815][ T6410] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 121.205271][ T6410] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.231785][ T6410] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.246321][ T6410] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.254555][ T6410] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.282159][ T6410] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.337951][ T6410] hsr_slave_0: entered promiscuous mode [ 121.344575][ T6410] hsr_slave_1: entered promiscuous mode [ 121.957879][ T6410] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 121.968983][ T6410] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 121.981249][ T6410] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 121.995578][ T6410] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 122.107683][ T6410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.131031][ T6410] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.143924][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.151076][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.167297][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.174814][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.393340][ T51] Bluetooth: hci0: command tx timeout [ 122.429631][ T6410] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.484687][ T6410] veth0_vlan: entered promiscuous mode [ 122.498600][ T6410] veth1_vlan: entered promiscuous mode [ 122.535489][ T6410] veth0_macvtap: entered promiscuous mode [ 122.545336][ T6410] veth1_macvtap: entered promiscuous mode [ 122.567744][ T6410] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.588293][ T6410] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.608998][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.619010][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.635688][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.645950][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.728689][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.745959][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.776570][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.785672][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.863497][ T6498] BUG: Bad page state in process syz.0.17 pfn:34a3e [ 122.870372][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x34a3e [ 122.880619][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 122.887804][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 122.896544][ T6498] raw: ffff888000000000 3fffffffffffffff 00000000ffffffff 0000000000000000 [ 122.905236][ T6498] page dumped because: page_pool leak [ 122.910797][ T6498] page_owner tracks the page as allocated [ 122.916814][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863351263, free_ts 118515860341 [ 122.933928][ T6498] post_alloc_hook+0x231/0x280 [ 122.938822][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 122.944559][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 122.950512][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 122.956173][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 122.962356][ T6498] page_pool_alloc_frag_netmem+0x421/0x9b0 [ 122.968449][ T6498] skb_pp_cow_data+0xc43/0x1680 [ 122.973530][ T6498] do_xdp_generic+0x76b/0x12e0 [ 122.978761][ T6498] tun_get_user+0x247d/0x3dd0 [ 122.984093][ T6498] tun_chr_write_iter+0x113/0x200 [ 122.989227][ T6498] vfs_write+0x61d/0xb90 [ 122.993619][ T6498] ksys_write+0x150/0x270 [ 122.997969][ T6498] do_syscall_64+0x14d/0xf80 [ 123.002754][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.008897][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 123.015557][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 123.020716][ T6498] tlb_finish_mmu+0x144/0x230 [ 123.025486][ T6498] exit_mmap+0x498/0xa10 [ 123.030021][ T6498] __mmput+0x118/0x430 [ 123.034254][ T6498] exit_mm+0x168/0x220 [ 123.038350][ T6498] do_exit+0x6a2/0x23c0 [ 123.042537][ T6498] do_group_exit+0x21b/0x2d0 [ 123.047204][ T6498] get_signal+0x1284/0x1330 [ 123.051809][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 123.057443][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 123.062815][ T6498] do_syscall_64+0x32d/0xf80 [ 123.067431][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.073480][ T6498] Modules linked in: [ 123.077559][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 123.077582][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 123.077599][ T6498] Call Trace: [ 123.077607][ T6498] [ 123.077614][ T6498] dump_stack_lvl+0xe8/0x150 [ 123.077641][ T6498] bad_page+0x17f/0x1c0 [ 123.077667][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 123.077696][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 123.077737][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 123.077761][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 123.077784][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 123.077833][ T6498] do_xdp_generic+0xac5/0x12e0 [ 123.077866][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 123.077914][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 123.077932][ T6498] tun_get_user+0x247d/0x3dd0 [ 123.077959][ T6498] ? aa_file_perm+0x192/0x15e0 [ 123.077980][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 123.077995][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 123.078010][ T6498] ? aa_file_perm+0x192/0x15e0 [ 123.078030][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 123.078055][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 123.078078][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 123.078107][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 123.078133][ T6498] ? tun_get+0x1c/0x2f0 [ 123.078152][ T6498] ? tun_get+0x1c/0x2f0 [ 123.078167][ T6498] ? tun_get+0x1c/0x2f0 [ 123.078188][ T6498] tun_chr_write_iter+0x113/0x200 [ 123.078208][ T6498] vfs_write+0x61d/0xb90 [ 123.078235][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 123.078262][ T6498] ? __fget_files+0x2a/0x420 [ 123.078296][ T6498] ksys_write+0x150/0x270 [ 123.078316][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 123.078344][ T6498] do_syscall_64+0x14d/0xf80 [ 123.078363][ T6498] ? trace_irq_disable+0x3b/0x150 [ 123.078387][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.078405][ T6498] ? clear_bhb_loop+0x40/0x90 [ 123.078427][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.078445][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 123.078461][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 123.078474][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.078493][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 123.078506][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 123.078523][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 123.078534][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.078543][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 123.078569][ T6498] [ 123.078574][ T6498] Disabling lock debugging due to kernel taint [ 123.356797][ T6498] BUG: Bad page state in process syz.0.17 pfn:28460 [ 123.363509][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028460000 pfn:0x28460 [ 123.375007][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 123.382418][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 123.391174][ T6498] raw: ffff888028460000 0000000000000001 00000000ffffffff 0000000000000000 [ 123.399800][ T6498] page dumped because: page_pool leak [ 123.405302][ T6498] page_owner tracks the page as allocated [ 123.411106][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863328834, free_ts 118515874371 [ 123.428778][ T6498] post_alloc_hook+0x231/0x280 [ 123.433600][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 123.439171][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 123.445041][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 123.450502][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 123.456600][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 123.461466][ T6498] do_xdp_generic+0x76b/0x12e0 [ 123.466246][ T6498] tun_get_user+0x247d/0x3dd0 [ 123.471265][ T6498] tun_chr_write_iter+0x113/0x200 [ 123.476486][ T6498] vfs_write+0x61d/0xb90 [ 123.480810][ T6498] ksys_write+0x150/0x270 [ 123.485247][ T6498] do_syscall_64+0x14d/0xf80 [ 123.489838][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.495783][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 123.502343][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 123.507600][ T6498] tlb_finish_mmu+0x144/0x230 [ 123.512383][ T6498] exit_mmap+0x498/0xa10 [ 123.516749][ T6498] __mmput+0x118/0x430 [ 123.520841][ T6498] exit_mm+0x168/0x220 [ 123.525301][ T6498] do_exit+0x6a2/0x23c0 [ 123.529473][ T6498] do_group_exit+0x21b/0x2d0 [ 123.534485][ T6498] get_signal+0x1284/0x1330 [ 123.539275][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 123.545004][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 123.550385][ T6498] do_syscall_64+0x32d/0xf80 [ 123.555351][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.561518][ T6498] Modules linked in: [ 123.565619][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 123.565642][ T6498] Tainted: [B]=BAD_PAGE [ 123.565647][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 123.565655][ T6498] Call Trace: [ 123.565660][ T6498] [ 123.565666][ T6498] dump_stack_lvl+0xe8/0x150 [ 123.565690][ T6498] bad_page+0x17f/0x1c0 [ 123.565713][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 123.565731][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 123.565756][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 123.565772][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 123.565786][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 123.565816][ T6498] do_xdp_generic+0xac5/0x12e0 [ 123.565842][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 123.565873][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 123.565891][ T6498] tun_get_user+0x247d/0x3dd0 [ 123.565912][ T6498] ? aa_file_perm+0x192/0x15e0 [ 123.565929][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 123.565943][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 123.565958][ T6498] ? aa_file_perm+0x192/0x15e0 [ 123.565974][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 123.565996][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 123.566022][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 123.566047][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 123.566073][ T6498] ? tun_get+0x1c/0x2f0 [ 123.566089][ T6498] ? tun_get+0x1c/0x2f0 [ 123.566104][ T6498] ? tun_get+0x1c/0x2f0 [ 123.566120][ T6498] tun_chr_write_iter+0x113/0x200 [ 123.566138][ T6498] vfs_write+0x61d/0xb90 [ 123.566157][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 123.566178][ T6498] ? __fget_files+0x2a/0x420 [ 123.566205][ T6498] ksys_write+0x150/0x270 [ 123.566223][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 123.566244][ T6498] do_syscall_64+0x14d/0xf80 [ 123.566261][ T6498] ? trace_irq_disable+0x3b/0x150 [ 123.566285][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.566301][ T6498] ? clear_bhb_loop+0x40/0x90 [ 123.566319][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.566335][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 123.566350][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 123.566364][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.566382][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 123.566395][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 123.566405][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 123.566416][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.566425][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 123.566444][ T6498] [ 123.566454][ T6498] BUG: Bad page state in process syz.0.17 pfn:72a44 [ 123.846590][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72a44 [ 123.855408][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 123.863102][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 123.872510][ T6498] raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 [ 123.881151][ T6498] page dumped because: page_pool leak [ 123.886602][ T6498] page_owner tracks the page as allocated [ 123.892921][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863313417, free_ts 118515888332 [ 123.910428][ T6498] post_alloc_hook+0x231/0x280 [ 123.915610][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 123.921362][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 123.928685][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 123.934383][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 123.940527][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 123.945970][ T6498] do_xdp_generic+0x76b/0x12e0 [ 123.950824][ T6498] tun_get_user+0x247d/0x3dd0 [ 123.955612][ T6498] tun_chr_write_iter+0x113/0x200 [ 123.960825][ T6498] vfs_write+0x61d/0xb90 [ 123.965108][ T6498] ksys_write+0x150/0x270 [ 123.969454][ T6498] do_syscall_64+0x14d/0xf80 [ 123.974208][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.980551][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 123.987016][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 123.992451][ T6498] tlb_finish_mmu+0x144/0x230 [ 123.997454][ T6498] exit_mmap+0x498/0xa10 [ 124.001792][ T6498] __mmput+0x118/0x430 [ 124.005927][ T6498] exit_mm+0x168/0x220 [ 124.010181][ T6498] do_exit+0x6a2/0x23c0 [ 124.014600][ T6498] do_group_exit+0x21b/0x2d0 [ 124.019294][ T6498] get_signal+0x1284/0x1330 [ 124.024272][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 124.030195][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 124.036336][ T6498] do_syscall_64+0x32d/0xf80 [ 124.041194][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.047503][ T6498] Modules linked in: [ 124.051849][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 124.051866][ T6498] Tainted: [B]=BAD_PAGE [ 124.051869][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 124.051875][ T6498] Call Trace: [ 124.051879][ T6498] [ 124.051884][ T6498] dump_stack_lvl+0xe8/0x150 [ 124.051901][ T6498] bad_page+0x17f/0x1c0 [ 124.051916][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 124.051928][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 124.051944][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 124.051955][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 124.051964][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 124.051982][ T6498] do_xdp_generic+0xac5/0x12e0 [ 124.051996][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 124.052013][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 124.052023][ T6498] tun_get_user+0x247d/0x3dd0 [ 124.052035][ T6498] ? aa_file_perm+0x192/0x15e0 [ 124.052044][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 124.052052][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 124.052060][ T6498] ? aa_file_perm+0x192/0x15e0 [ 124.052070][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 124.052083][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 124.052094][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 124.052109][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 124.052124][ T6498] ? tun_get+0x1c/0x2f0 [ 124.052133][ T6498] ? tun_get+0x1c/0x2f0 [ 124.052141][ T6498] ? tun_get+0x1c/0x2f0 [ 124.052150][ T6498] tun_chr_write_iter+0x113/0x200 [ 124.052160][ T6498] vfs_write+0x61d/0xb90 [ 124.052172][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 124.052182][ T6498] ? __fget_files+0x2a/0x420 [ 124.052198][ T6498] ksys_write+0x150/0x270 [ 124.052208][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 124.052220][ T6498] do_syscall_64+0x14d/0xf80 [ 124.052230][ T6498] ? trace_irq_disable+0x3b/0x150 [ 124.052244][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.052254][ T6498] ? clear_bhb_loop+0x40/0x90 [ 124.052264][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.052273][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 124.052284][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 124.052292][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.052302][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 124.052309][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 124.052315][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 124.052321][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.052328][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 124.052344][ T6498] [ 124.052353][ T6498] BUG: Bad page state in process syz.0.17 pfn:34a93 [ 124.350229][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x34a93 [ 124.360840][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 124.367983][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 124.377849][ T6498] raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000 [ 124.386845][ T6498] page dumped because: page_pool leak [ 124.392735][ T6498] page_owner tracks the page as allocated [ 124.398955][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863298012, free_ts 118515902742 [ 124.416253][ T6498] post_alloc_hook+0x231/0x280 [ 124.421200][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 124.426818][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 124.432669][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 124.438322][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 124.444415][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 124.449652][ T6498] do_xdp_generic+0x76b/0x12e0 [ 124.454573][ T6498] tun_get_user+0x247d/0x3dd0 [ 124.459642][ T6498] tun_chr_write_iter+0x113/0x200 [ 124.465348][ T6498] vfs_write+0x61d/0xb90 [ 124.470124][ T6498] ksys_write+0x150/0x270 [ 124.472932][ T51] Bluetooth: hci0: command tx timeout [ 124.474638][ T6498] do_syscall_64+0x14d/0xf80 [ 124.484922][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.490925][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 124.497906][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 124.503222][ T6498] tlb_finish_mmu+0x144/0x230 [ 124.507996][ T6498] exit_mmap+0x498/0xa10 [ 124.512431][ T6498] __mmput+0x118/0x430 [ 124.516915][ T6498] exit_mm+0x168/0x220 [ 124.520998][ T6498] do_exit+0x6a2/0x23c0 [ 124.525190][ T6498] do_group_exit+0x21b/0x2d0 [ 124.531278][ T6498] get_signal+0x1284/0x1330 [ 124.535924][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 124.541745][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 124.547054][ T6498] do_syscall_64+0x32d/0xf80 [ 124.551648][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.557584][ T6498] Modules linked in: [ 124.561569][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 124.561585][ T6498] Tainted: [B]=BAD_PAGE [ 124.561588][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 124.561594][ T6498] Call Trace: [ 124.561598][ T6498] [ 124.561602][ T6498] dump_stack_lvl+0xe8/0x150 [ 124.561620][ T6498] bad_page+0x17f/0x1c0 [ 124.561635][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 124.561647][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 124.561664][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 124.561683][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 124.561692][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 124.561710][ T6498] do_xdp_generic+0xac5/0x12e0 [ 124.561724][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 124.561741][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 124.561751][ T6498] tun_get_user+0x247d/0x3dd0 [ 124.561762][ T6498] ? aa_file_perm+0x192/0x15e0 [ 124.561772][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 124.561780][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 124.561788][ T6498] ? aa_file_perm+0x192/0x15e0 [ 124.561797][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 124.561810][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 124.561821][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 124.561836][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 124.561851][ T6498] ? tun_get+0x1c/0x2f0 [ 124.561860][ T6498] ? tun_get+0x1c/0x2f0 [ 124.561868][ T6498] ? tun_get+0x1c/0x2f0 [ 124.561877][ T6498] tun_chr_write_iter+0x113/0x200 [ 124.561887][ T6498] vfs_write+0x61d/0xb90 [ 124.561899][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 124.561910][ T6498] ? __fget_files+0x2a/0x420 [ 124.561925][ T6498] ksys_write+0x150/0x270 [ 124.561936][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 124.561947][ T6498] do_syscall_64+0x14d/0xf80 [ 124.561957][ T6498] ? trace_irq_disable+0x3b/0x150 [ 124.561972][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.561982][ T6498] ? clear_bhb_loop+0x40/0x90 [ 124.561992][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.562001][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 124.562011][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 124.562018][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.562029][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 124.562037][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 124.562043][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 124.562049][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.562054][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 124.562064][ T6498] [ 124.562071][ T6498] BUG: Bad page state in process syz.0.17 pfn:33672 [ 124.843943][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888033672dc0 pfn:0x33672 [ 124.854259][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 124.861821][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 124.870527][ T6498] raw: ffff888033672dc0 0000000000000001 00000000ffffffff 0000000000000000 [ 124.879118][ T6498] page dumped because: page_pool leak [ 124.884633][ T6498] page_owner tracks the page as allocated [ 124.890412][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863283010, free_ts 118515914826 [ 124.908240][ T6498] post_alloc_hook+0x231/0x280 [ 124.913132][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 124.918979][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 124.924928][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 124.930581][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 124.936810][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 124.941762][ T6498] do_xdp_generic+0x76b/0x12e0 [ 124.946597][ T6498] tun_get_user+0x247d/0x3dd0 [ 124.951294][ T6498] tun_chr_write_iter+0x113/0x200 [ 124.956447][ T6498] vfs_write+0x61d/0xb90 [ 124.960855][ T6498] ksys_write+0x150/0x270 [ 124.965221][ T6498] do_syscall_64+0x14d/0xf80 [ 124.970158][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.976289][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 124.982660][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 124.987910][ T6498] tlb_finish_mmu+0x144/0x230 [ 124.992594][ T6498] exit_mmap+0x498/0xa10 [ 124.996858][ T6498] __mmput+0x118/0x430 [ 125.000930][ T6498] exit_mm+0x168/0x220 [ 125.005027][ T6498] do_exit+0x6a2/0x23c0 [ 125.009176][ T6498] do_group_exit+0x21b/0x2d0 [ 125.013774][ T6498] get_signal+0x1284/0x1330 [ 125.018274][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 125.023968][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 125.029274][ T6498] do_syscall_64+0x32d/0xf80 [ 125.033904][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.039884][ T6498] Modules linked in: [ 125.043809][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 125.043831][ T6498] Tainted: [B]=BAD_PAGE [ 125.043836][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 125.043844][ T6498] Call Trace: [ 125.043850][ T6498] [ 125.043856][ T6498] dump_stack_lvl+0xe8/0x150 [ 125.043881][ T6498] bad_page+0x17f/0x1c0 [ 125.043903][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 125.043923][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 125.043948][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 125.043968][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 125.043984][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 125.044017][ T6498] do_xdp_generic+0xac5/0x12e0 [ 125.044043][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 125.044074][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 125.044088][ T6498] tun_get_user+0x247d/0x3dd0 [ 125.044107][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.044124][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 125.044138][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 125.044153][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.044169][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 125.044192][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 125.044211][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 125.044236][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 125.044262][ T6498] ? tun_get+0x1c/0x2f0 [ 125.044279][ T6498] ? tun_get+0x1c/0x2f0 [ 125.044293][ T6498] ? tun_get+0x1c/0x2f0 [ 125.044310][ T6498] tun_chr_write_iter+0x113/0x200 [ 125.044327][ T6498] vfs_write+0x61d/0xb90 [ 125.044347][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 125.044367][ T6498] ? __fget_files+0x2a/0x420 [ 125.044394][ T6498] ksys_write+0x150/0x270 [ 125.044412][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 125.044433][ T6498] do_syscall_64+0x14d/0xf80 [ 125.044450][ T6498] ? trace_irq_disable+0x3b/0x150 [ 125.044472][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.044489][ T6498] ? clear_bhb_loop+0x40/0x90 [ 125.044507][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.044523][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 125.044538][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.044553][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.044571][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 125.044583][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 125.044594][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 125.044604][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.044614][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 125.044632][ T6498] [ 125.044643][ T6498] BUG: Bad page state in process syz.0.17 pfn:789a7 [ 125.321253][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x789a7 [ 125.330177][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 125.337354][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 125.346869][ T6498] raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000 [ 125.355578][ T6498] page dumped because: page_pool leak [ 125.361036][ T6498] page_owner tracks the page as allocated [ 125.366778][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863269632, free_ts 118515928630 [ 125.383643][ T6498] post_alloc_hook+0x231/0x280 [ 125.388410][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 125.394009][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 125.399993][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 125.405593][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 125.411924][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 125.416790][ T6498] do_xdp_generic+0x76b/0x12e0 [ 125.421550][ T6498] tun_get_user+0x247d/0x3dd0 [ 125.426352][ T6498] tun_chr_write_iter+0x113/0x200 [ 125.431380][ T6498] vfs_write+0x61d/0xb90 [ 125.435703][ T6498] ksys_write+0x150/0x270 [ 125.440078][ T6498] do_syscall_64+0x14d/0xf80 [ 125.444711][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.450599][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 125.456950][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 125.462062][ T6498] tlb_finish_mmu+0x144/0x230 [ 125.466785][ T6498] exit_mmap+0x498/0xa10 [ 125.471023][ T6498] __mmput+0x118/0x430 [ 125.475117][ T6498] exit_mm+0x168/0x220 [ 125.479182][ T6498] do_exit+0x6a2/0x23c0 [ 125.483535][ T6498] do_group_exit+0x21b/0x2d0 [ 125.488154][ T6498] get_signal+0x1284/0x1330 [ 125.492670][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 125.498241][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 125.503716][ T6498] do_syscall_64+0x32d/0xf80 [ 125.508393][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.514456][ T6498] Modules linked in: [ 125.518360][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 125.518376][ T6498] Tainted: [B]=BAD_PAGE [ 125.518380][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 125.518385][ T6498] Call Trace: [ 125.518390][ T6498] [ 125.518395][ T6498] dump_stack_lvl+0xe8/0x150 [ 125.518419][ T6498] bad_page+0x17f/0x1c0 [ 125.518434][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 125.518446][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 125.518463][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 125.518474][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 125.518484][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 125.518502][ T6498] do_xdp_generic+0xac5/0x12e0 [ 125.518516][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 125.518533][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 125.518543][ T6498] tun_get_user+0x247d/0x3dd0 [ 125.518554][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.518563][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 125.518571][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 125.518579][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.518589][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 125.518602][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 125.518613][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 125.518628][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 125.518643][ T6498] ? tun_get+0x1c/0x2f0 [ 125.518652][ T6498] ? tun_get+0x1c/0x2f0 [ 125.518660][ T6498] ? tun_get+0x1c/0x2f0 [ 125.518669][ T6498] tun_chr_write_iter+0x113/0x200 [ 125.518679][ T6498] vfs_write+0x61d/0xb90 [ 125.518691][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 125.518702][ T6498] ? __fget_files+0x2a/0x420 [ 125.518718][ T6498] ksys_write+0x150/0x270 [ 125.518728][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 125.518739][ T6498] do_syscall_64+0x14d/0xf80 [ 125.518750][ T6498] ? trace_irq_disable+0x3b/0x150 [ 125.518764][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.518774][ T6498] ? clear_bhb_loop+0x40/0x90 [ 125.518784][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.518794][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 125.518804][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.518812][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.518823][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 125.518830][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 125.518836][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 125.518842][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.518847][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 125.518857][ T6498] [ 125.518864][ T6498] BUG: Bad page state in process syz.0.17 pfn:32b3b [ 125.795568][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032b3b780 pfn:0x32b3b [ 125.805663][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 125.813595][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 125.822172][ T6498] raw: ffff888032b3b780 0000000000000001 00000000ffffffff 0000000000000000 [ 125.830765][ T6498] page dumped because: page_pool leak [ 125.836170][ T6498] page_owner tracks the page as allocated [ 125.841967][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863252811, free_ts 118515943180 [ 125.859039][ T6498] post_alloc_hook+0x231/0x280 [ 125.863839][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 125.869396][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 125.875409][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 125.881057][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 125.887289][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 125.892147][ T6498] do_xdp_generic+0x76b/0x12e0 [ 125.896935][ T6498] tun_get_user+0x247d/0x3dd0 [ 125.901611][ T6498] tun_chr_write_iter+0x113/0x200 [ 125.906670][ T6498] vfs_write+0x61d/0xb90 [ 125.910916][ T6498] ksys_write+0x150/0x270 [ 125.915292][ T6498] do_syscall_64+0x14d/0xf80 [ 125.919980][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.925888][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 125.932204][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 125.937338][ T6498] tlb_finish_mmu+0x144/0x230 [ 125.942040][ T6498] exit_mmap+0x498/0xa10 [ 125.946385][ T6498] __mmput+0x118/0x430 [ 125.950457][ T6498] exit_mm+0x168/0x220 [ 125.954685][ T6498] do_exit+0x6a2/0x23c0 [ 125.959175][ T6498] do_group_exit+0x21b/0x2d0 [ 125.963993][ T6498] get_signal+0x1284/0x1330 [ 125.968504][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 125.974077][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 125.979376][ T6498] do_syscall_64+0x32d/0xf80 [ 125.984102][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.989999][ T6498] Modules linked in: [ 125.993991][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 125.994013][ T6498] Tainted: [B]=BAD_PAGE [ 125.994018][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 125.994027][ T6498] Call Trace: [ 125.994033][ T6498] [ 125.994039][ T6498] dump_stack_lvl+0xe8/0x150 [ 125.994063][ T6498] bad_page+0x17f/0x1c0 [ 125.994086][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 125.994105][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 125.994131][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 125.994149][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 125.994165][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 125.994198][ T6498] do_xdp_generic+0xac5/0x12e0 [ 125.994224][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 125.994256][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 125.994273][ T6498] tun_get_user+0x247d/0x3dd0 [ 125.994293][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.994310][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 125.994324][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 125.994339][ T6498] ? aa_file_perm+0x192/0x15e0 [ 125.994356][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 125.994380][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 125.994400][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 125.994424][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 125.994451][ T6498] ? tun_get+0x1c/0x2f0 [ 125.994469][ T6498] ? tun_get+0x1c/0x2f0 [ 125.994484][ T6498] ? tun_get+0x1c/0x2f0 [ 125.994502][ T6498] tun_chr_write_iter+0x113/0x200 [ 125.994519][ T6498] vfs_write+0x61d/0xb90 [ 125.994540][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 125.994561][ T6498] ? __fget_files+0x2a/0x420 [ 125.994590][ T6498] ksys_write+0x150/0x270 [ 125.994608][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 125.994630][ T6498] do_syscall_64+0x14d/0xf80 [ 125.994648][ T6498] ? trace_irq_disable+0x3b/0x150 [ 125.994681][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.994698][ T6498] ? clear_bhb_loop+0x40/0x90 [ 125.994717][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.994734][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 125.994749][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.994763][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.994781][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 125.994794][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 125.994806][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 125.994817][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.994827][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 125.994846][ T6498] [ 125.994856][ T6498] BUG: Bad page state in process syz.0.17 pfn:32fad [ 126.273016][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032fad000 pfn:0x32fad [ 126.283187][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 126.290342][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 126.299036][ T6498] raw: ffff888032fad000 0000000000000001 00000000ffffffff 0000000000000000 [ 126.307638][ T6498] page dumped because: page_pool leak [ 126.313026][ T6498] page_owner tracks the page as allocated [ 126.318734][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863237025, free_ts 118515956982 [ 126.335771][ T6498] post_alloc_hook+0x231/0x280 [ 126.340714][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 126.346404][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 126.352400][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 126.357942][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 126.364124][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 126.368964][ T6498] do_xdp_generic+0x76b/0x12e0 [ 126.373861][ T6498] tun_get_user+0x247d/0x3dd0 [ 126.378824][ T6498] tun_chr_write_iter+0x113/0x200 [ 126.384044][ T6498] vfs_write+0x61d/0xb90 [ 126.388300][ T6498] ksys_write+0x150/0x270 [ 126.392643][ T6498] do_syscall_64+0x14d/0xf80 [ 126.397433][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.403455][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 126.409859][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 126.415017][ T6498] tlb_finish_mmu+0x144/0x230 [ 126.419696][ T6498] exit_mmap+0x498/0xa10 [ 126.423968][ T6498] __mmput+0x118/0x430 [ 126.428044][ T6498] exit_mm+0x168/0x220 [ 126.432110][ T6498] do_exit+0x6a2/0x23c0 [ 126.436304][ T6498] do_group_exit+0x21b/0x2d0 [ 126.440996][ T6498] get_signal+0x1284/0x1330 [ 126.445546][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 126.451128][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 126.456482][ T6498] do_syscall_64+0x32d/0xf80 [ 126.461108][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.467129][ T6498] Modules linked in: [ 126.471132][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 126.471150][ T6498] Tainted: [B]=BAD_PAGE [ 126.471154][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 126.471160][ T6498] Call Trace: [ 126.471166][ T6498] [ 126.471171][ T6498] dump_stack_lvl+0xe8/0x150 [ 126.471189][ T6498] bad_page+0x17f/0x1c0 [ 126.471205][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 126.471218][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 126.471234][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 126.471245][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 126.471254][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 126.471272][ T6498] do_xdp_generic+0xac5/0x12e0 [ 126.471286][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 126.471303][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 126.471313][ T6498] tun_get_user+0x247d/0x3dd0 [ 126.471324][ T6498] ? aa_file_perm+0x192/0x15e0 [ 126.471334][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 126.471342][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 126.471350][ T6498] ? aa_file_perm+0x192/0x15e0 [ 126.471359][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 126.471378][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 126.471389][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 126.471403][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 126.471418][ T6498] ? tun_get+0x1c/0x2f0 [ 126.471428][ T6498] ? tun_get+0x1c/0x2f0 [ 126.471436][ T6498] ? tun_get+0x1c/0x2f0 [ 126.471445][ T6498] tun_chr_write_iter+0x113/0x200 [ 126.471454][ T6498] vfs_write+0x61d/0xb90 [ 126.471466][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 126.471477][ T6498] ? __fget_files+0x2a/0x420 [ 126.471493][ T6498] ksys_write+0x150/0x270 [ 126.471503][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 126.471514][ T6498] do_syscall_64+0x14d/0xf80 [ 126.471525][ T6498] ? trace_irq_disable+0x3b/0x150 [ 126.471539][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.471549][ T6498] ? clear_bhb_loop+0x40/0x90 [ 126.471559][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.471569][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 126.471579][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 126.471587][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.471599][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 126.471606][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 126.471612][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 126.471618][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.471624][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 126.471633][ T6498] [ 126.471641][ T6498] BUG: Bad page state in process syz.0.17 pfn:29881 [ 126.552911][ T51] Bluetooth: hci0: command tx timeout [ 126.556562][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029881c80 pfn:0x29881 [ 126.770135][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 126.777286][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 126.786005][ T6498] raw: ffff888029881c80 0000000000000001 00000000ffffffff 0000000000000000 [ 126.794782][ T6498] page dumped because: page_pool leak [ 126.800149][ T6498] page_owner tracks the page as allocated [ 126.805927][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863219311, free_ts 118515970832 [ 126.823137][ T6498] post_alloc_hook+0x231/0x280 [ 126.828031][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 126.833616][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 126.839441][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 126.844924][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 126.850993][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 126.855883][ T6498] do_xdp_generic+0x76b/0x12e0 [ 126.860776][ T6498] tun_get_user+0x247d/0x3dd0 [ 126.865616][ T6498] tun_chr_write_iter+0x113/0x200 [ 126.870823][ T6498] vfs_write+0x61d/0xb90 [ 126.875101][ T6498] ksys_write+0x150/0x270 [ 126.879613][ T6498] do_syscall_64+0x14d/0xf80 [ 126.884512][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.890688][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 126.897085][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 126.902870][ T6498] tlb_finish_mmu+0x144/0x230 [ 126.907845][ T6498] exit_mmap+0x498/0xa10 [ 126.912188][ T6498] __mmput+0x118/0x430 [ 126.916630][ T6498] exit_mm+0x168/0x220 [ 126.920869][ T6498] do_exit+0x6a2/0x23c0 [ 126.925212][ T6498] do_group_exit+0x21b/0x2d0 [ 126.929898][ T6498] get_signal+0x1284/0x1330 [ 126.934429][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 126.940004][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 126.945384][ T6498] do_syscall_64+0x32d/0xf80 [ 126.950107][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.956229][ T6498] Modules linked in: [ 126.960195][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 126.960212][ T6498] Tainted: [B]=BAD_PAGE [ 126.960215][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 126.960222][ T6498] Call Trace: [ 126.960226][ T6498] [ 126.960230][ T6498] dump_stack_lvl+0xe8/0x150 [ 126.960248][ T6498] bad_page+0x17f/0x1c0 [ 126.960264][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 126.960318][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 126.960335][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 126.960346][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 126.960355][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 126.960373][ T6498] do_xdp_generic+0xac5/0x12e0 [ 126.960387][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 126.960404][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 126.960415][ T6498] tun_get_user+0x247d/0x3dd0 [ 126.960426][ T6498] ? aa_file_perm+0x192/0x15e0 [ 126.960435][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 126.960444][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 126.960452][ T6498] ? aa_file_perm+0x192/0x15e0 [ 126.960461][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 126.960474][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 126.960486][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 126.960500][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 126.960515][ T6498] ? tun_get+0x1c/0x2f0 [ 126.960524][ T6498] ? tun_get+0x1c/0x2f0 [ 126.960532][ T6498] ? tun_get+0x1c/0x2f0 [ 126.960541][ T6498] tun_chr_write_iter+0x113/0x200 [ 126.960551][ T6498] vfs_write+0x61d/0xb90 [ 126.960563][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 126.960574][ T6498] ? __fget_files+0x2a/0x420 [ 126.960590][ T6498] ksys_write+0x150/0x270 [ 126.960600][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 126.960611][ T6498] do_syscall_64+0x14d/0xf80 [ 126.960621][ T6498] ? trace_irq_disable+0x3b/0x150 [ 126.960636][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.960646][ T6498] ? clear_bhb_loop+0x40/0x90 [ 126.960657][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.960666][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 126.960676][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 126.960684][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.960695][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 126.960703][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 126.960709][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 126.960715][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.960720][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 126.960730][ T6498] [ 126.960737][ T6498] BUG: Bad page state in process syz.0.17 pfn:34c8d [ 127.242839][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034c8d000 pfn:0x34c8d [ 127.252980][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 127.260100][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 127.269017][ T6498] raw: ffff888034c8d000 0000000000000001 00000000ffffffff 0000000000000000 [ 127.277655][ T6498] page dumped because: page_pool leak [ 127.283052][ T6498] page_owner tracks the page as allocated [ 127.288853][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863204030, free_ts 118515984732 [ 127.305726][ T6498] post_alloc_hook+0x231/0x280 [ 127.310489][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 127.316089][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 127.322169][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 127.327669][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 127.333771][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 127.338702][ T6498] do_xdp_generic+0x76b/0x12e0 [ 127.343499][ T6498] tun_get_user+0x247d/0x3dd0 [ 127.348186][ T6498] tun_chr_write_iter+0x113/0x200 [ 127.353328][ T6498] vfs_write+0x61d/0xb90 [ 127.357604][ T6498] ksys_write+0x150/0x270 [ 127.361912][ T6498] do_syscall_64+0x14d/0xf80 [ 127.366523][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.372542][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 127.379076][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 127.384324][ T6498] tlb_finish_mmu+0x144/0x230 [ 127.389085][ T6498] exit_mmap+0x498/0xa10 [ 127.393428][ T6498] __mmput+0x118/0x430 [ 127.397493][ T6498] exit_mm+0x168/0x220 [ 127.401540][ T6498] do_exit+0x6a2/0x23c0 [ 127.405712][ T6498] do_group_exit+0x21b/0x2d0 [ 127.410319][ T6498] get_signal+0x1284/0x1330 [ 127.414848][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 127.420391][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 127.425703][ T6498] do_syscall_64+0x32d/0xf80 [ 127.430294][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.436198][ T6498] Modules linked in: [ 127.440090][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 127.440105][ T6498] Tainted: [B]=BAD_PAGE [ 127.440108][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 127.440114][ T6498] Call Trace: [ 127.440118][ T6498] [ 127.440123][ T6498] dump_stack_lvl+0xe8/0x150 [ 127.440139][ T6498] bad_page+0x17f/0x1c0 [ 127.440154][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 127.440166][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 127.440182][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 127.440193][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 127.440202][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 127.440219][ T6498] do_xdp_generic+0xac5/0x12e0 [ 127.440233][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 127.440250][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 127.440260][ T6498] tun_get_user+0x247d/0x3dd0 [ 127.440272][ T6498] ? aa_file_perm+0x192/0x15e0 [ 127.440281][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 127.440289][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 127.440298][ T6498] ? aa_file_perm+0x192/0x15e0 [ 127.440306][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 127.440320][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 127.440331][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 127.440346][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 127.440361][ T6498] ? tun_get+0x1c/0x2f0 [ 127.440370][ T6498] ? tun_get+0x1c/0x2f0 [ 127.440378][ T6498] ? tun_get+0x1c/0x2f0 [ 127.440387][ T6498] tun_chr_write_iter+0x113/0x200 [ 127.440397][ T6498] vfs_write+0x61d/0xb90 [ 127.440408][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 127.440419][ T6498] ? __fget_files+0x2a/0x420 [ 127.440436][ T6498] ksys_write+0x150/0x270 [ 127.440446][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 127.440457][ T6498] do_syscall_64+0x14d/0xf80 [ 127.440467][ T6498] ? trace_irq_disable+0x3b/0x150 [ 127.440481][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.440490][ T6498] ? clear_bhb_loop+0x40/0x90 [ 127.440501][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.440510][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 127.440519][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.440528][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.440538][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 127.440545][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 127.440551][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 127.440561][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.440567][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 127.440577][ T6498] [ 127.440583][ T6498] BUG: Bad page state in process syz.0.17 pfn:3294d [ 127.720701][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803294d000 pfn:0x3294d [ 127.730806][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 127.737948][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 127.746833][ T6498] raw: ffff88803294d000 0000000000000001 00000000ffffffff 0000000000000000 [ 127.755453][ T6498] page dumped because: page_pool leak [ 127.760819][ T6498] page_owner tracks the page as allocated [ 127.766578][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863188529, free_ts 118515998895 [ 127.783446][ T6498] post_alloc_hook+0x231/0x280 [ 127.788226][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 127.793819][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 127.799714][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 127.805194][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 127.811283][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 127.816149][ T6498] do_xdp_generic+0x76b/0x12e0 [ 127.820911][ T6498] tun_get_user+0x247d/0x3dd0 [ 127.825606][ T6498] tun_chr_write_iter+0x113/0x200 [ 127.830623][ T6498] vfs_write+0x61d/0xb90 [ 127.834912][ T6498] ksys_write+0x150/0x270 [ 127.839329][ T6498] do_syscall_64+0x14d/0xf80 [ 127.843964][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.849881][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 127.856324][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 127.861437][ T6498] tlb_finish_mmu+0x144/0x230 [ 127.866139][ T6498] exit_mmap+0x498/0xa10 [ 127.870383][ T6498] __mmput+0x118/0x430 [ 127.874584][ T6498] exit_mm+0x168/0x220 [ 127.878652][ T6498] do_exit+0x6a2/0x23c0 [ 127.882845][ T6498] do_group_exit+0x21b/0x2d0 [ 127.887512][ T6498] get_signal+0x1284/0x1330 [ 127.891993][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 127.897570][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 127.902876][ T6498] do_syscall_64+0x32d/0xf80 [ 127.907453][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.913498][ T6498] Modules linked in: [ 127.917409][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 127.917425][ T6498] Tainted: [B]=BAD_PAGE [ 127.917428][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 127.917434][ T6498] Call Trace: [ 127.917439][ T6498] [ 127.917443][ T6498] dump_stack_lvl+0xe8/0x150 [ 127.917461][ T6498] bad_page+0x17f/0x1c0 [ 127.917476][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 127.917492][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 127.917509][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 127.917520][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 127.917529][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 127.917547][ T6498] do_xdp_generic+0xac5/0x12e0 [ 127.917561][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 127.917578][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 127.917588][ T6498] tun_get_user+0x247d/0x3dd0 [ 127.917599][ T6498] ? aa_file_perm+0x192/0x15e0 [ 127.917608][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 127.917616][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 127.917625][ T6498] ? aa_file_perm+0x192/0x15e0 [ 127.917634][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 127.917647][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 127.917658][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 127.917673][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 127.917688][ T6498] ? tun_get+0x1c/0x2f0 [ 127.917697][ T6498] ? tun_get+0x1c/0x2f0 [ 127.917705][ T6498] ? tun_get+0x1c/0x2f0 [ 127.917714][ T6498] tun_chr_write_iter+0x113/0x200 [ 127.917724][ T6498] vfs_write+0x61d/0xb90 [ 127.917736][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 127.917747][ T6498] ? __fget_files+0x2a/0x420 [ 127.917763][ T6498] ksys_write+0x150/0x270 [ 127.917773][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 127.917784][ T6498] do_syscall_64+0x14d/0xf80 [ 127.917795][ T6498] ? trace_irq_disable+0x3b/0x150 [ 127.917809][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.917818][ T6498] ? clear_bhb_loop+0x40/0x90 [ 127.917829][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.917838][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 127.917848][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.917855][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.917867][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 127.917874][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 127.917880][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 127.917886][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.917891][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 127.917901][ T6498] [ 127.917908][ T6498] BUG: Bad page state in process syz.0.17 pfn:36aff [ 128.195155][ T6498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036aff000 pfn:0x36aff [ 128.205341][ T6498] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 128.212509][ T6498] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 128.221204][ T6498] raw: ffff888036aff000 0000000000000001 00000000ffffffff 0000000000000000 [ 128.229974][ T6498] page dumped because: page_pool leak [ 128.235379][ T6498] page_owner tracks the page as allocated [ 128.241261][ T6498] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863170108, free_ts 118516012951 [ 128.258170][ T6498] post_alloc_hook+0x231/0x280 [ 128.262970][ T6498] get_page_from_freelist+0x24dc/0x2580 [ 128.268514][ T6498] __alloc_frozen_pages_noprof+0x18d/0x380 [ 128.274466][ T6498] alloc_pages_bulk_noprof+0x558/0x700 [ 128.279944][ T6498] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 128.286077][ T6498] skb_pp_cow_data+0xc21/0x1680 [ 128.291213][ T6498] do_xdp_generic+0x76b/0x12e0 [ 128.296001][ T6498] tun_get_user+0x247d/0x3dd0 [ 128.300794][ T6498] tun_chr_write_iter+0x113/0x200 [ 128.305947][ T6498] vfs_write+0x61d/0xb90 [ 128.310200][ T6498] ksys_write+0x150/0x270 [ 128.314574][ T6498] do_syscall_64+0x14d/0xf80 [ 128.319162][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.325093][ T6498] page last free pid 6339 tgid 6339 stack trace: [ 128.331435][ T6498] __free_frozen_pages+0xc2b/0xdb0 [ 128.336749][ T6498] tlb_finish_mmu+0x144/0x230 [ 128.341834][ T6498] exit_mmap+0x498/0xa10 [ 128.346287][ T6498] __mmput+0x118/0x430 [ 128.350393][ T6498] exit_mm+0x168/0x220 [ 128.354673][ T6498] do_exit+0x6a2/0x23c0 [ 128.358852][ T6498] do_group_exit+0x21b/0x2d0 [ 128.363468][ T6498] get_signal+0x1284/0x1330 [ 128.367986][ T6498] arch_do_signal_or_restart+0xbc/0x830 [ 128.373572][ T6498] exit_to_user_mode_loop+0x86/0x480 [ 128.378870][ T6498] do_syscall_64+0x32d/0xf80 [ 128.383508][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.389590][ T6498] Modules linked in: [ 128.393530][ T6498] CPU: 1 UID: 0 PID: 6498 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 128.393557][ T6498] Tainted: [B]=BAD_PAGE [ 128.393562][ T6498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 128.393570][ T6498] Call Trace: [ 128.393575][ T6498] [ 128.393581][ T6498] dump_stack_lvl+0xe8/0x150 [ 128.393605][ T6498] bad_page+0x17f/0x1c0 [ 128.393626][ T6498] __free_frozen_pages+0xd62/0xdb0 [ 128.393645][ T6498] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 128.393670][ T6498] bpf_xdp_adjust_tail+0x1d6/0x220 [ 128.393688][ T6498] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 128.393702][ T6498] bpf_prog_run_generic_xdp+0x603/0x1490 [ 128.393735][ T6498] do_xdp_generic+0xac5/0x12e0 [ 128.393761][ T6498] ? __pfx_do_xdp_generic+0x10/0x10 [ 128.393793][ T6498] ? tun_get_user+0x2354/0x3dd0 [ 128.393810][ T6498] tun_get_user+0x247d/0x3dd0 [ 128.393830][ T6498] ? aa_file_perm+0x192/0x15e0 [ 128.393847][ T6498] ? aa_file_perm+0x50e/0x15e0 [ 128.393862][ T6498] ? __pfx_tun_get_user+0x10/0x10 [ 128.393876][ T6498] ? aa_file_perm+0x192/0x15e0 [ 128.393892][ T6498] ? __lock_acquire+0x6b5/0x2cf0 [ 128.393914][ T6498] ? preempt_schedule_common+0x82/0xd0 [ 128.393933][ T6498] ? ref_tracker_alloc+0x35c/0x4c0 [ 128.393959][ T6498] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 128.393985][ T6498] ? tun_get+0x1c/0x2f0 [ 128.394001][ T6498] ? tun_get+0x1c/0x2f0 [ 128.394015][ T6498] ? tun_get+0x1c/0x2f0 [ 128.394030][ T6498] tun_chr_write_iter+0x113/0x200 [ 128.394046][ T6498] vfs_write+0x61d/0xb90 [ 128.394065][ T6498] ? __pfx_vfs_write+0x10/0x10 [ 128.394085][ T6498] ? __fget_files+0x2a/0x420 [ 128.394112][ T6498] ksys_write+0x150/0x270 [ 128.394130][ T6498] ? __pfx_ksys_write+0x10/0x10 [ 128.394150][ T6498] do_syscall_64+0x14d/0xf80 [ 128.394168][ T6498] ? trace_irq_disable+0x3b/0x150 [ 128.394192][ T6498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.394265][ T6498] ? clear_bhb_loop+0x40/0x90 [ 128.394284][ T6498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.394300][ T6498] RIP: 0033:0x7f51e9b5b7ce [ 128.394315][ T6498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 128.394328][ T6498] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.394346][ T6498] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 128.394359][ T6498] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 128.394369][ T6498] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 128.394379][ T6498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.394390][ T6498] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 128.394407][ T6498] [ 128.676525][ T51] Bluetooth: hci0: command tx timeout 2026/03/23 13:23:33 executed programs: 3 [ 128.797860][ T6516] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x34a3e [ 128.808267][ T6516] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 128.815530][ T6516] raw: 00fff00000000000 dead000000000040 ffff88801ab7d000 0000000000000000 [ 128.824138][ T6516] raw: ffff888000000000 3fffffffffffffff 00000000ffffffff 0000000000000000 [ 128.832705][ T6516] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 128.840927][ T6516] page_owner tracks the page as allocated [ 128.846692][ T6516] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 6498, tgid 6497 (syz.0.17), ts 122863351263, free_ts 118515860341 [ 128.863962][ T6516] post_alloc_hook+0x231/0x280 [ 128.868909][ T6516] get_page_from_freelist+0x24dc/0x2580 [ 128.874932][ T6516] __alloc_frozen_pages_noprof+0x18d/0x380 [ 128.880916][ T6516] alloc_pages_bulk_noprof+0x558/0x700 [ 128.886391][ T6516] __page_pool_alloc_netmems_slow+0x14c/0x710 [ 128.892549][ T6516] page_pool_alloc_frag_netmem+0x421/0x9b0 [ 128.898500][ T6516] skb_pp_cow_data+0xc43/0x1680 [ 128.903379][ T6516] do_xdp_generic+0x76b/0x12e0 [ 128.908165][ T6516] tun_get_user+0x247d/0x3dd0 [ 128.913222][ T6516] tun_chr_write_iter+0x113/0x200 [ 128.918260][ T6516] vfs_write+0x61d/0xb90 [ 128.922505][ T6516] ksys_write+0x150/0x270 [ 128.927032][ T6516] do_syscall_64+0x14d/0xf80 [ 128.931623][ T6516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.937555][ T6516] page last free pid 6339 tgid 6339 stack trace: [ 128.944006][ T6516] __free_frozen_pages+0xc2b/0xdb0 [ 128.949220][ T6516] tlb_finish_mmu+0x144/0x230 [ 128.953924][ T6516] exit_mmap+0x498/0xa10 [ 128.958190][ T6516] __mmput+0x118/0x430 [ 128.962299][ T6516] exit_mm+0x168/0x220 [ 128.966564][ T6516] do_exit+0x6a2/0x23c0 [ 128.970731][ T6516] do_group_exit+0x21b/0x2d0 [ 128.975458][ T6516] get_signal+0x1284/0x1330 [ 128.979965][ T6516] arch_do_signal_or_restart+0xbc/0x830 [ 128.985975][ T6516] exit_to_user_mode_loop+0x86/0x480 [ 128.991291][ T6516] do_syscall_64+0x32d/0xf80 [ 128.995917][ T6516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.001937][ T6516] ------------[ cut here ]------------ [ 129.007695][ T6516] kernel BUG at ./include/linux/mm.h:1493! [ 129.013721][ T6516] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 129.020141][ T6516] CPU: 1 UID: 0 PID: 6516 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT(full) [ 129.031322][ T6516] Tainted: [B]=BAD_PAGE [ 129.035639][ T6516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 129.045942][ T6516] RIP: 0010:page_frag_free+0x182/0x240 [ 129.051395][ T6516] Code: 38 c1 0f 8c 64 ff ff ff 4c 89 f7 e8 d8 36 0d 00 e9 57 ff ff ff e8 ce f4 a2 ff 48 89 df 48 c7 c6 e0 d4 da 8b e8 ef 6d 05 ff 90 <0f> 0b 48 89 de 48 81 e6 ff 0f 00 00 31 ff e8 8b f9 a2 ff 48 89 d8 [ 129.071345][ T6516] RSP: 0018:ffffc90002f17488 EFLAGS: 00010246 [ 129.077413][ T6516] RAX: 2b0fb606da3e2300 RBX: ffffea0000d28f80 RCX: 0000000000000201 [ 129.085567][ T6516] RDX: 0000000000000000 RSI: ffffffff8c27c1e0 RDI: ffff888030b00000 [ 129.093978][ T6516] RBP: 0000000000000000 R08: ffffc90002f16ea7 R09: 1ffff920005e2dd4 [ 129.102036][ T6516] R10: dffffc0000000000 R11: fffff520005e2dd5 R12: dffffc0000000000 [ 129.110091][ T6516] R13: 000000000000bcdd R14: ffffea0000d28fb4 R15: dead000000000040 [ 129.118051][ T6516] FS: 00007f51e91fe6c0(0000) GS:ffff88812555d000(0000) knlGS:0000000000000000 [ 129.126968][ T6516] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.133536][ T6516] CR2: 0000200000010000 CR3: 000000003411e000 CR4: 00000000003526f0 [ 129.141499][ T6516] Call Trace: [ 129.144764][ T6516] [ 129.147683][ T6516] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 129.153314][ T6516] bpf_xdp_adjust_tail+0x1d6/0x220 [ 129.159107][ T6516] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 129.164553][ T6516] bpf_prog_run_generic_xdp+0x603/0x1490 [ 129.170268][ T6516] ? lock_release+0x4b/0x3d0 [ 129.175118][ T6516] do_xdp_generic+0xac5/0x12e0 [ 129.179963][ T6516] ? __pfx_do_xdp_generic+0x10/0x10 [ 129.185182][ T6516] ? skb_header_pointer+0x8e/0x120 [ 129.190376][ T6516] ? lock_acquire+0x57/0x2e0 [ 129.195043][ T6516] ? tun_get_user+0x2354/0x3dd0 [ 129.200069][ T6516] tun_get_user+0x247d/0x3dd0 [ 129.204754][ T6516] ? futex_unqueue+0x22/0x240 [ 129.209448][ T6516] ? aa_file_perm+0x50e/0x15e0 [ 129.214290][ T6516] ? __pfx_tun_get_user+0x10/0x10 [ 129.219395][ T6516] ? aa_file_perm+0x192/0x15e0 [ 129.224184][ T6516] ? __pfx___futex_wait+0x10/0x10 [ 129.229230][ T6516] ? ref_tracker_alloc+0x35c/0x4c0 [ 129.234348][ T6516] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 129.239820][ T6516] ? tun_get+0x1c/0x2f0 [ 129.244048][ T6516] ? rcu_is_watching+0x15/0xb0 [ 129.248976][ T6516] ? tun_get+0x1c/0x2f0 [ 129.253202][ T6516] ? lock_release+0x4b/0x3d0 [ 129.257786][ T6516] ? apparmor_file_permission+0x1f4/0x300 [ 129.263595][ T6516] ? tun_get+0x1c/0x2f0 [ 129.267753][ T6516] tun_chr_write_iter+0x113/0x200 [ 129.272796][ T6516] vfs_write+0x61d/0xb90 [ 129.277051][ T6516] ? __pfx_vfs_write+0x10/0x10 [ 129.281827][ T6516] ? __fget_files+0x2a/0x420 [ 129.286411][ T6516] ksys_write+0x150/0x270 [ 129.290731][ T6516] ? __pfx_ksys_write+0x10/0x10 [ 129.295573][ T6516] ? rcu_is_watching+0x15/0xb0 [ 129.300333][ T6516] do_syscall_64+0x14d/0xf80 [ 129.304926][ T6516] ? trace_irq_disable+0x3b/0x150 [ 129.309963][ T6516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.316038][ T6516] ? clear_bhb_loop+0x40/0x90 [ 129.320969][ T6516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.327475][ T6516] RIP: 0033:0x7f51e9b5b7ce [ 129.331878][ T6516] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 129.351655][ T6516] RSP: 002b:00007f51e91fdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.360076][ T6516] RAX: ffffffffffffffda RBX: 00007f51e91fe6c0 RCX: 00007f51e9b5b7ce [ 129.368039][ T6516] RDX: 000000000000fdef RSI: 0000200000000a80 RDI: 00000000000000c8 [ 129.376117][ T6516] RBP: 00007f51e9c2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 129.384085][ T6516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.392139][ T6516] R13: 00007f51e9e06038 R14: 00007f51e9e05fa0 R15: 00007ffef1a2a6a8 [ 129.400455][ T6516] [ 129.403476][ T6516] Modules linked in: [ 129.407481][ T6516] ---[ end trace 0000000000000000 ]--- [ 129.412967][ T6516] RIP: 0010:page_frag_free+0x182/0x240 [ 129.418623][ T6516] Code: 38 c1 0f 8c 64 ff ff ff 4c 89 f7 e8 d8 36 0d 00 e9 57 ff ff ff e8 ce f4 a2 ff 48 89 df 48 c7 c6 e0 d4 da 8b e8 ef 6d 05 ff 90 <0f> 0b 48 89 de 48 81 e6 ff 0f 00 00 31 ff e8 8b f9 a2 ff 48 89 d8 [ 129.438300][ T6516] RSP: 0018:ffffc90002f17488 EFLAGS: 00010246 [ 129.444497][ T6516] RAX: 2b0fb606da3e2300 RBX: ffffea0000d28f80 RCX: 0000000000000201 [ 129.452472][ T6516] RDX: 0000000000000000 RSI: ffffffff8c27c1e0 RDI: ffff888030b00000 [ 129.460482][ T6516] RBP: 0000000000000000 R08: ffffc90002f16ea7 R09: 1ffff920005e2dd4 [ 129.468480][ T6516] R10: dffffc0000000000 R11: fffff520005e2dd5 R12: dffffc0000000000 [ 129.476665][ T6516] R13: 000000000000bcdd R14: ffffea0000d28fb4 R15: dead000000000040 [ 129.484840][ T6516] FS: 00007f51e91fe6c0(0000) GS:ffff88812555d000(0000) knlGS:0000000000000000 [ 129.493805][ T6516] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.500420][ T6516] CR2: 0000200000010000 CR3: 000000003411e000 CR4: 00000000003526f0 [ 129.508417][ T6516] Kernel panic - not syncing: Fatal exception in interrupt [ 129.516462][ T6516] Kernel Offset: disabled [ 129.520773][ T6516] Rebooting in 86400 seconds..