BUG: Bad page state in process syz.2.15  pfn:117b21
page:ffffea00045ec840 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117b21
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675766153, free_ts 58369867418
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Not tainted 6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:1171b0
page:ffffea00045c6c00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1171b0
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675762866, free_ts 58369872651
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:114dc3
page:ffffea00045370c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114dc3
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675759744, free_ts 58369876092
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:117d0e
page:ffffea00045f4380 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117d0e
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675756468, free_ts 58369879786
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:116115
page:ffffea0004584540 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116115
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675753413, free_ts 58369891308
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:117973
page:ffffea00045e5cc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117973
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675750070, free_ts 58369894476
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:11776b
page:ffffea00045ddac0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11776b
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675746778, free_ts 58369905491
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:116c67
page:ffffea00045b19c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c67
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675743206, free_ts 58369908702
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:115b16
page:ffffea000456c580 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115b16
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675740029, free_ts 58369911674
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:17b676
page:ffffea0005ed9d80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17b676
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675736808, free_ts 58369914781
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>
BUG: Bad page state in process syz.2.15  pfn:117e0d
page:ffffea00045f8340 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117e0d
flags: 0x100000000000000(node=0|zone=2)
page_type: 0xffffffff()
raw: 0100000000000000 dead000000000040 ffff888103298000 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102820(GFP_ATOMIC|__GFP_NOWARN|__GFP_HARDWALL), pid 4318, tgid 4317 (syz.2.15), ts 58675733328, free_ts 58369925988
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x15a/0x180 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x17b9/0x1920 mm/page_alloc.c:3311
 __alloc_pages+0x11f/0x280 mm/page_alloc.c:4567
 __alloc_pages_bulk+0x442/0x6b0 mm/page_alloc.c:4515
 alloc_pages_bulk_array_node include/linux/gfp.h:211 [inline]
 __page_pool_alloc_pages_slow+0x69/0x210 net/core/page_pool.c:488
 page_pool_alloc include/net/page_pool/helpers.h:125 [inline]
 page_pool_dev_alloc include/net/page_pool/helpers.h:163 [inline]
 skb_pp_cow_data net/core/skbuff.c:952 [inline]
 skb_cow_data_for_xdp+0x372/0x560 net/core/skbuff.c:985
 netif_skb_check_for_xdp net/core/dev.c:4959 [inline]
 netif_receive_generic_xdp net/core/dev.c:4998 [inline]
 do_xdp_generic+0xec/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
page last free pid 3490 tgid 3490 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x3db/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 vfree+0x7a/0xe0 mm/vmalloc.c:2842
 delayed_vfree_work+0x1b/0x30 mm/vmalloc.c:2763
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x250/0x4d0 kernel/workqueue.c:2706
 worker_thread+0x23d/0x300 kernel/workqueue.c:2787
 kthread+0xe9/0x100 kernel/kthread.c:388
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Modules linked in:
CPU: 0 PID: 4318 Comm: syz.2.15 Tainted: G    B              6.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 bad_page+0xdd/0xf0 mm/page_alloc.c:514
 free_page_is_bad mm/page_alloc.c:967 [inline]
 free_pages_prepare mm/page_alloc.c:1132 [inline]
 free_unref_page_prepare+0x453/0x470 mm/page_alloc.c:2346
 free_unref_page+0x37/0x260 mm/page_alloc.c:2486
 bpf_xdp_shrink_data net/core/filter.c:4129 [inline]
 bpf_xdp_frags_shrink_tail+0x141/0x1e0 net/core/filter.c:4150
 ____bpf_xdp_adjust_tail net/core/filter.c:4175 [inline]
 bpf_xdp_adjust_tail+0x75/0x80 net/core/filter.c:4168
 ___bpf_prog_run+0x5f6/0x2280 kernel/bpf/core.c:1986
 __bpf_prog_run32+0xbb/0xe0 kernel/bpf/core.c:2225
 bpf_dispatcher_nop_func include/linux/bpf.h:1235 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run_xdp include/net/xdp.h:514 [inline]
 bpf_prog_run_generic_xdp+0x12f/0x370 net/core/dev.c:4891
 netif_receive_generic_xdp net/core/dev.c:5004 [inline]
 do_xdp_generic+0x1a2/0x300 net/core/dev.c:5063
 __netif_receive_skb_core+0x61b/0xf20 net/core/dev.c:5404
 __netif_receive_skb_one_core net/core/dev.c:5582 [inline]
 __netif_receive_skb+0x3b/0x160 net/core/dev.c:5698
 netif_receive_skb_internal net/core/dev.c:5784 [inline]
 netif_receive_skb+0x78/0x1f0 net/core/dev.c:5843
 tun_rx_batched+0x1be/0x200
 tun_get_user+0xf4a/0x12f0 drivers/net/tun.c:2007
 tun_chr_write_iter+0x5a/0xc0 drivers/net/tun.c:2053
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x3f9/0x4c0 fs/read_write.c:590
 ksys_write+0x70/0xe0 fs/read_write.c:643
 do_syscall_64+0x94/0x1a0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f9f4537e98f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f9f461a0020 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f45545fa0 RCX: 00007f9f4537e98f
RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
RBP: 00007f9f453f3cc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f45545fa0 R15: 00007fff3e3c3428
 </TASK>