Warning: Permanently added '10.128.0.243' (ED25519) to the list of known hosts. 2026/05/12 07:10:47 parsed 1 programs [ 96.534992][ T5636] cgroup: Unknown subsys name 'net' [ 96.653893][ T5636] cgroup: Unknown subsys name 'cpuset' [ 96.664929][ T5636] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 98.419144][ T5636] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.042795][ T29] cfg80211: failed to load regulatory.db [ 101.594106][ T5652] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 104.042882][ T4944] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 104.050891][ T4944] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 104.059018][ T4944] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 104.067924][ T4944] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 104.079689][ T4944] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 105.316174][ T5711] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.323526][ T5711] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.331366][ T5711] bridge_slave_0: entered allmulticast mode [ 105.339621][ T5711] bridge_slave_0: entered promiscuous mode [ 105.350205][ T5711] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.357374][ T5711] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.364676][ T5711] bridge_slave_1: entered allmulticast mode [ 105.372597][ T5711] bridge_slave_1: entered promiscuous mode [ 105.404597][ T5711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.416505][ T5711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.451035][ T5711] team0: Port device team_slave_0 added [ 105.461288][ T5711] team0: Port device team_slave_1 added [ 105.489365][ T5711] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.496335][ T5711] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.522449][ T5711] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.535522][ T5711] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.542566][ T5711] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.568745][ T5711] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.615293][ T5711] hsr_slave_0: entered promiscuous mode [ 105.622507][ T5711] hsr_slave_1: entered promiscuous mode [ 105.798797][ T5711] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.815176][ T5711] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.824623][ T5711] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.834845][ T5711] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.843869][ T5711] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.857917][ T5711] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.866008][ T5711] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.877540][ T5711] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.915319][ T5711] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.923302][ T5711] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.931269][ T5711] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.938532][ T5711] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.007576][ T5711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.030392][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.039557][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.058121][ T5711] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.073458][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.080706][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.097601][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.104803][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.494899][ T5711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.547563][ T5711] veth0_vlan: entered promiscuous mode [ 106.562656][ T5711] veth1_vlan: entered promiscuous mode [ 106.596677][ T5711] veth0_macvtap: entered promiscuous mode [ 106.607357][ T5711] veth1_macvtap: entered promiscuous mode [ 106.627384][ T5711] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.645862][ T5711] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.663941][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.681794][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.691214][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.713069][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.870174][ T48] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.964640][ T48] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.076191][ T48] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.156143][ T48] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.263485][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.276310][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.316605][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.325493][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/05/12 07:11:02 executed programs: 0 [ 108.220590][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 108.229752][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 108.237506][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 108.248752][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 108.256735][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 108.881508][ T48] bridge_slave_1: left allmulticast mode [ 108.887272][ T48] bridge_slave_1: left promiscuous mode [ 108.895329][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.907990][ T48] bridge_slave_0: left allmulticast mode [ 108.915648][ T48] bridge_slave_0: left promiscuous mode [ 108.922390][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.126904][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 109.139582][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.150468][ T48] bond0 (unregistering): Released all slaves [ 109.163690][ T5761] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.170905][ T5761] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.178180][ T5761] bridge_slave_0: entered allmulticast mode [ 109.186559][ T5761] bridge_slave_0: entered promiscuous mode [ 109.199880][ T5761] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.207983][ T5761] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.215316][ T5761] bridge_slave_1: entered allmulticast mode [ 109.225410][ T5761] bridge_slave_1: entered promiscuous mode [ 109.281748][ T5761] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.296493][ T5761] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.312159][ T48] hsr_slave_0: left promiscuous mode [ 109.318193][ T48] hsr_slave_1: left promiscuous mode [ 109.324909][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 109.332552][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 109.341225][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.348708][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 109.363152][ T48] veth1_macvtap: left promiscuous mode [ 109.369549][ T48] veth0_macvtap: left promiscuous mode [ 109.375503][ T48] veth1_vlan: left promiscuous mode [ 109.380934][ T48] veth0_vlan: left promiscuous mode [ 109.601270][ T48] team0 (unregistering): Port device team_slave_1 removed [ 109.621014][ T48] team0 (unregistering): Port device team_slave_0 removed [ 109.798980][ T5761] team0: Port device team_slave_0 added [ 109.813619][ T5761] team0: Port device team_slave_1 added [ 109.873045][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.880499][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.907475][ T5761] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.933035][ T5761] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.950847][ T5761] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.979268][ T5761] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.043871][ T5761] hsr_slave_0: entered promiscuous mode [ 110.050711][ T5761] hsr_slave_1: entered promiscuous mode [ 110.319790][ T50] Bluetooth: hci0: command tx timeout [ 110.513241][ T5288] 8021q: adding VLAN 0 to HW filter on device eth1 [ 111.006583][ T5761] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 111.020170][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.029828][ T5761] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 111.058160][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.069073][ T5761] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 111.088006][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.102752][ T5761] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 111.119601][ T5761] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.236642][ T5761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.264967][ T5761] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.282129][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.289379][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.309935][ T140] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.317206][ T140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.872169][ T5761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.950193][ T5761] veth0_vlan: entered promiscuous mode [ 111.966566][ T5761] veth1_vlan: entered promiscuous mode [ 112.014979][ T5761] veth0_macvtap: entered promiscuous mode [ 112.030144][ T5761] veth1_macvtap: entered promiscuous mode [ 112.057803][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.078637][ T5761] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.105144][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.120190][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.142803][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.172026][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.256476][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.280953][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.337712][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.347173][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.399069][ T50] Bluetooth: hci0: command tx timeout [ 112.439019][ T5847] BUG: Bad page state in process syz.0.17 pfn:34b1e [ 112.445782][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034b1e000 pfn:0x34b1e [ 112.456716][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 112.463944][ T5847] page_type: f9(unknown) [ 112.468263][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 112.476888][ T5847] raw: ffff888034b1e000 3fffffffffffffff 00000000f9000000 0000000000000000 [ 112.485573][ T5847] page dumped because: page_pool leak [ 112.491042][ T5847] page_owner tracks the page as allocated [ 112.496943][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438777874, free_ts 112265589849 [ 112.514701][ T5847] post_alloc_hook+0x231/0x280 [ 112.519609][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 112.525220][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 112.531136][ T5847] __alloc_pages_noprof+0x10/0x100 [ 112.536306][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 112.541877][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 112.547988][ T5847] page_pool_alloc_frag_netmem+0x421/0x9b0 [ 112.553871][ T5847] skb_pp_cow_data+0xcb7/0x19b0 [ 112.558799][ T5847] do_xdp_generic+0x76b/0x12e0 [ 112.563596][ T5847] tun_get_user+0x24ca/0x43e0 [ 112.568368][ T5847] tun_chr_write_iter+0x113/0x200 [ 112.573453][ T5847] vfs_write+0x61d/0xb90 [ 112.577769][ T5847] ksys_write+0x150/0x270 [ 112.582194][ T5847] do_syscall_64+0x15f/0xf80 [ 112.586848][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.592883][ T5847] page last free pid 15 tgid 15 stack trace: [ 112.598927][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 112.604090][ T5847] tlb_remove_table_rcu+0x85/0x100 [ 112.609290][ T5847] rcu_core+0x7cd/0x1070 [ 112.613576][ T5847] handle_softirqs+0x22a/0x840 [ 112.618420][ T5847] run_ksoftirqd+0x36/0x60 [ 112.622883][ T5847] smpboot_thread_fn+0x541/0xa50 [ 112.627870][ T5847] kthread+0x388/0x470 [ 112.632035][ T5847] ret_from_fork+0x514/0xb70 [ 112.636669][ T5847] ret_from_fork_asm+0x1a/0x30 [ 112.641529][ T5847] Modules linked in: [ 112.645579][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 112.645616][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 112.645644][ T5847] Call Trace: [ 112.645656][ T5847] [ 112.645664][ T5847] dump_stack_lvl+0xe8/0x150 [ 112.645692][ T5847] bad_page+0x17f/0x1c0 [ 112.645727][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 112.645769][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 112.645815][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 112.645839][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 112.645903][ T5847] do_xdp_generic+0xac5/0x12e0 [ 112.645924][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 112.645957][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 112.645987][ T5847] ? tun_get_user+0x2394/0x43e0 [ 112.646032][ T5847] ? tun_get_user+0x2394/0x43e0 [ 112.646058][ T5847] tun_get_user+0x24ca/0x43e0 [ 112.646101][ T5847] ? aa_file_perm+0x192/0x15e0 [ 112.646136][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 112.646166][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 112.646196][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 112.646235][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 112.646268][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 112.646300][ T5847] ? tun_get+0x1c/0x2f0 [ 112.646327][ T5847] ? tun_get+0x1c/0x2f0 [ 112.646358][ T5847] ? tun_get+0x1c/0x2f0 [ 112.646391][ T5847] ? tun_get+0x1c/0x2f0 [ 112.646423][ T5847] tun_chr_write_iter+0x113/0x200 [ 112.646454][ T5847] vfs_write+0x61d/0xb90 [ 112.646495][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 112.646528][ T5847] ? __pfx_do_futex+0x10/0x10 [ 112.646571][ T5847] ksys_write+0x150/0x270 [ 112.646605][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 112.646646][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.646670][ T5847] do_syscall_64+0x15f/0xf80 [ 112.646700][ T5847] ? trace_irq_disable+0x3b/0x140 [ 112.646740][ T5847] ? clear_bhb_loop+0x40/0x90 [ 112.646767][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.646789][ T5847] RIP: 0033:0x7f58e5f5d60e [ 112.646810][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 112.646827][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.646849][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 112.646865][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 112.646878][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 112.646891][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.646904][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 112.646938][ T5847] [ 112.646946][ T5847] Disabling lock debugging due to kernel taint [ 112.916074][ T5847] BUG: Bad page state in process syz.0.17 pfn:2aa44 [ 112.922813][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802aa44640 pfn:0x2aa44 [ 112.932935][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 112.940116][ T5847] page_type: f9(unknown) [ 112.944386][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 112.953037][ T5847] raw: ffff88802aa44640 0000000000000001 00000000f9000000 0000000000000000 [ 112.961686][ T5847] page dumped because: page_pool leak [ 112.967085][ T5847] page_owner tracks the page as allocated [ 112.972940][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438747120, free_ts 112279950601 [ 112.989844][ T5847] post_alloc_hook+0x231/0x280 [ 112.994636][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 113.000277][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 113.006206][ T5847] __alloc_pages_noprof+0x10/0x100 [ 113.011390][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 113.016885][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 113.023105][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 113.027988][ T5847] do_xdp_generic+0x76b/0x12e0 [ 113.032910][ T5847] tun_get_user+0x24ca/0x43e0 [ 113.037616][ T5847] tun_chr_write_iter+0x113/0x200 [ 113.042713][ T5847] vfs_write+0x61d/0xb90 [ 113.047080][ T5847] ksys_write+0x150/0x270 [ 113.051482][ T5847] do_syscall_64+0x15f/0xf80 [ 113.056109][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.062059][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 113.068432][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 113.073667][ T5847] rcu_core+0x7cd/0x1070 [ 113.077919][ T5847] handle_softirqs+0x22a/0x840 [ 113.082750][ T5847] __irq_exit_rcu+0xca/0x220 [ 113.087462][ T5847] irq_exit_rcu+0x9/0x30 [ 113.091777][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 113.097454][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 113.103499][ T5847] Modules linked in: [ 113.107422][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 113.107443][ T5847] Tainted: [B]=BAD_PAGE [ 113.107448][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 113.107457][ T5847] Call Trace: [ 113.107464][ T5847] [ 113.107469][ T5847] dump_stack_lvl+0xe8/0x150 [ 113.107488][ T5847] bad_page+0x17f/0x1c0 [ 113.107508][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 113.107530][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 113.107552][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 113.107565][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 113.107599][ T5847] do_xdp_generic+0xac5/0x12e0 [ 113.107611][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 113.107630][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 113.107647][ T5847] ? tun_get_user+0x2394/0x43e0 [ 113.107671][ T5847] ? tun_get_user+0x2394/0x43e0 [ 113.107709][ T5847] tun_get_user+0x24ca/0x43e0 [ 113.107734][ T5847] ? aa_file_perm+0x192/0x15e0 [ 113.107756][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 113.107776][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 113.107795][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 113.107815][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 113.107841][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 113.107863][ T5847] ? tun_get+0x1c/0x2f0 [ 113.107880][ T5847] ? tun_get+0x1c/0x2f0 [ 113.107899][ T5847] ? tun_get+0x1c/0x2f0 [ 113.107916][ T5847] ? tun_get+0x1c/0x2f0 [ 113.107934][ T5847] tun_chr_write_iter+0x113/0x200 [ 113.107953][ T5847] vfs_write+0x61d/0xb90 [ 113.107977][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 113.107998][ T5847] ? __pfx_do_futex+0x10/0x10 [ 113.108021][ T5847] ksys_write+0x150/0x270 [ 113.108042][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 113.108064][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.108079][ T5847] do_syscall_64+0x15f/0xf80 [ 113.108099][ T5847] ? trace_irq_disable+0x3b/0x140 [ 113.108121][ T5847] ? clear_bhb_loop+0x40/0x90 [ 113.108137][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.108151][ T5847] RIP: 0033:0x7f58e5f5d60e [ 113.108164][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 113.108176][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.108191][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 113.108202][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 113.108211][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 113.108244][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.108256][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 113.108279][ T5847] [ 113.375287][ T5847] BUG: Bad page state in process syz.0.17 pfn:33d0d [ 113.382032][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888033d0ddc0 pfn:0x33d0d [ 113.392164][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 113.399398][ T5847] page_type: f9(unknown) [ 113.403676][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 113.412350][ T5847] raw: ffff888033d0ddc0 0000000000000001 00000000f9000000 0000000000000000 [ 113.421023][ T5847] page dumped because: page_pool leak [ 113.426507][ T5847] page_owner tracks the page as allocated [ 113.432304][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438730265, free_ts 112279990326 [ 113.449204][ T5847] post_alloc_hook+0x231/0x280 [ 113.453994][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 113.459624][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 113.465480][ T5847] __alloc_pages_noprof+0x10/0x100 [ 113.470671][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 113.476175][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 113.482516][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 113.487412][ T5847] do_xdp_generic+0x76b/0x12e0 [ 113.492450][ T5847] tun_get_user+0x24ca/0x43e0 [ 113.497161][ T5847] tun_chr_write_iter+0x113/0x200 [ 113.502301][ T5847] vfs_write+0x61d/0xb90 [ 113.506582][ T5847] ksys_write+0x150/0x270 [ 113.510987][ T5847] do_syscall_64+0x15f/0xf80 [ 113.515627][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.521630][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 113.527989][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 113.533191][ T5847] rcu_core+0x7cd/0x1070 [ 113.537502][ T5847] handle_softirqs+0x22a/0x840 [ 113.542346][ T5847] __irq_exit_rcu+0xca/0x220 [ 113.546965][ T5847] irq_exit_rcu+0x9/0x30 [ 113.551285][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 113.556959][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 113.563028][ T5847] Modules linked in: [ 113.566953][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 113.566975][ T5847] Tainted: [B]=BAD_PAGE [ 113.566980][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 113.566990][ T5847] Call Trace: [ 113.566996][ T5847] [ 113.567002][ T5847] dump_stack_lvl+0xe8/0x150 [ 113.567041][ T5847] bad_page+0x17f/0x1c0 [ 113.567068][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 113.567096][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 113.567126][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 113.567148][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 113.567183][ T5847] do_xdp_generic+0xac5/0x12e0 [ 113.567196][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 113.567218][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 113.567235][ T5847] ? tun_get_user+0x2394/0x43e0 [ 113.567259][ T5847] ? tun_get_user+0x2394/0x43e0 [ 113.567277][ T5847] tun_get_user+0x24ca/0x43e0 [ 113.567301][ T5847] ? aa_file_perm+0x192/0x15e0 [ 113.567324][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 113.567343][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 113.567362][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 113.567382][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 113.567404][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 113.567424][ T5847] ? tun_get+0x1c/0x2f0 [ 113.567441][ T5847] ? tun_get+0x1c/0x2f0 [ 113.567460][ T5847] ? tun_get+0x1c/0x2f0 [ 113.567477][ T5847] ? tun_get+0x1c/0x2f0 [ 113.567495][ T5847] tun_chr_write_iter+0x113/0x200 [ 113.567514][ T5847] vfs_write+0x61d/0xb90 [ 113.567539][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 113.567560][ T5847] ? __pfx_do_futex+0x10/0x10 [ 113.567583][ T5847] ksys_write+0x150/0x270 [ 113.567605][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 113.567628][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.567643][ T5847] do_syscall_64+0x15f/0xf80 [ 113.567676][ T5847] ? trace_irq_disable+0x3b/0x140 [ 113.567699][ T5847] ? clear_bhb_loop+0x40/0x90 [ 113.567721][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.567736][ T5847] RIP: 0033:0x7f58e5f5d60e [ 113.567749][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 113.567761][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.567777][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 113.567788][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 113.567797][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 113.567806][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.567815][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 113.567832][ T5847] [ 113.567841][ T5847] BUG: Bad page state in process syz.0.17 pfn:759ed [ 113.842369][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759edb40 pfn:0x759ed [ 113.852489][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 113.859643][ T5847] page_type: f9(unknown) [ 113.863886][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 113.872576][ T5847] raw: ffff8880759edb40 0000000000000001 00000000f9000000 0000000000000000 [ 113.881215][ T5847] page dumped because: page_pool leak [ 113.886588][ T5847] page_owner tracks the page as allocated [ 113.892387][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438712889, free_ts 112280018594 [ 113.909391][ T5847] post_alloc_hook+0x231/0x280 [ 113.914205][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 113.919803][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 113.925654][ T5847] __alloc_pages_noprof+0x10/0x100 [ 113.930861][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 113.936352][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 113.942476][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 113.947355][ T5847] do_xdp_generic+0x76b/0x12e0 [ 113.952166][ T5847] tun_get_user+0x24ca/0x43e0 [ 113.956904][ T5847] tun_chr_write_iter+0x113/0x200 [ 113.961980][ T5847] vfs_write+0x61d/0xb90 [ 113.966252][ T5847] ksys_write+0x150/0x270 [ 113.970639][ T5847] do_syscall_64+0x15f/0xf80 [ 113.975258][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.981203][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 113.987552][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 113.992731][ T5847] rcu_core+0x7cd/0x1070 [ 113.997000][ T5847] handle_softirqs+0x22a/0x840 [ 114.001809][ T5847] __irq_exit_rcu+0xca/0x220 [ 114.006425][ T5847] irq_exit_rcu+0x9/0x30 [ 114.010713][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 114.016384][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.022423][ T5847] Modules linked in: [ 114.026344][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 114.026366][ T5847] Tainted: [B]=BAD_PAGE [ 114.026371][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 114.026380][ T5847] Call Trace: [ 114.026386][ T5847] [ 114.026392][ T5847] dump_stack_lvl+0xe8/0x150 [ 114.026411][ T5847] bad_page+0x17f/0x1c0 [ 114.026430][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 114.026452][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 114.026475][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 114.026488][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 114.026521][ T5847] do_xdp_generic+0xac5/0x12e0 [ 114.026535][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.026554][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 114.026571][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.026595][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.026612][ T5847] tun_get_user+0x24ca/0x43e0 [ 114.026636][ T5847] ? aa_file_perm+0x192/0x15e0 [ 114.026658][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 114.026678][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 114.026697][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.026722][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 114.026743][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 114.026764][ T5847] ? tun_get+0x1c/0x2f0 [ 114.026781][ T5847] ? tun_get+0x1c/0x2f0 [ 114.026800][ T5847] ? tun_get+0x1c/0x2f0 [ 114.026817][ T5847] ? tun_get+0x1c/0x2f0 [ 114.026835][ T5847] tun_chr_write_iter+0x113/0x200 [ 114.026854][ T5847] vfs_write+0x61d/0xb90 [ 114.026879][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 114.026900][ T5847] ? __pfx_do_futex+0x10/0x10 [ 114.026923][ T5847] ksys_write+0x150/0x270 [ 114.026944][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 114.026968][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.026983][ T5847] do_syscall_64+0x15f/0xf80 [ 114.027004][ T5847] ? trace_irq_disable+0x3b/0x140 [ 114.027026][ T5847] ? clear_bhb_loop+0x40/0x90 [ 114.027042][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.027056][ T5847] RIP: 0033:0x7f58e5f5d60e [ 114.027070][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.027082][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.027098][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 114.027109][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 114.027118][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 114.027127][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.027136][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 114.027153][ T5847] [ 114.027162][ T5847] BUG: Bad page state in process syz.0.17 pfn:759e6 [ 114.301508][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759e6780 pfn:0x759e6 [ 114.311656][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 114.318840][ T5847] page_type: f9(unknown) [ 114.323090][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 114.331766][ T5847] raw: ffff8880759e6780 0000000000000001 00000000f9000000 0000000000000000 [ 114.340397][ T5847] page dumped because: page_pool leak [ 114.345774][ T5847] page_owner tracks the page as allocated [ 114.351549][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438695913, free_ts 112280036880 [ 114.368568][ T5847] post_alloc_hook+0x231/0x280 [ 114.373360][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 114.378975][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 114.384821][ T5847] __alloc_pages_noprof+0x10/0x100 [ 114.390115][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 114.395631][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 114.401771][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 114.406706][ T5847] do_xdp_generic+0x76b/0x12e0 [ 114.411524][ T5847] tun_get_user+0x24ca/0x43e0 [ 114.416230][ T5847] tun_chr_write_iter+0x113/0x200 [ 114.421318][ T5847] vfs_write+0x61d/0xb90 [ 114.425592][ T5847] ksys_write+0x150/0x270 [ 114.429979][ T5847] do_syscall_64+0x15f/0xf80 [ 114.434599][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.440546][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 114.446887][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 114.452057][ T5847] rcu_core+0x7cd/0x1070 [ 114.456328][ T5847] handle_softirqs+0x22a/0x840 [ 114.461133][ T5847] __irq_exit_rcu+0xca/0x220 [ 114.465726][ T5847] irq_exit_rcu+0x9/0x30 [ 114.470012][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 114.475675][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.478474][ T50] Bluetooth: hci0: command tx timeout [ 114.481716][ T5847] Modules linked in: [ 114.491014][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 114.491036][ T5847] Tainted: [B]=BAD_PAGE [ 114.491042][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 114.491051][ T5847] Call Trace: [ 114.491058][ T5847] [ 114.491064][ T5847] dump_stack_lvl+0xe8/0x150 [ 114.491083][ T5847] bad_page+0x17f/0x1c0 [ 114.491102][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 114.491124][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 114.491146][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 114.491159][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 114.491198][ T5847] do_xdp_generic+0xac5/0x12e0 [ 114.491211][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.491231][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 114.491248][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.491272][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.491290][ T5847] tun_get_user+0x24ca/0x43e0 [ 114.491314][ T5847] ? aa_file_perm+0x192/0x15e0 [ 114.491336][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 114.491356][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 114.491376][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.491396][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 114.491418][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 114.491439][ T5847] ? tun_get+0x1c/0x2f0 [ 114.491456][ T5847] ? tun_get+0x1c/0x2f0 [ 114.491475][ T5847] ? tun_get+0x1c/0x2f0 [ 114.491491][ T5847] ? tun_get+0x1c/0x2f0 [ 114.491509][ T5847] tun_chr_write_iter+0x113/0x200 [ 114.491528][ T5847] vfs_write+0x61d/0xb90 [ 114.491551][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 114.491572][ T5847] ? __pfx_do_futex+0x10/0x10 [ 114.491594][ T5847] ksys_write+0x150/0x270 [ 114.491615][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 114.491638][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.491653][ T5847] do_syscall_64+0x15f/0xf80 [ 114.491674][ T5847] ? trace_irq_disable+0x3b/0x140 [ 114.491695][ T5847] ? clear_bhb_loop+0x40/0x90 [ 114.491711][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.491726][ T5847] RIP: 0033:0x7f58e5f5d60e [ 114.491739][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.491750][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.491766][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 114.491776][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 114.491786][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 114.491794][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.491803][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 114.491819][ T5847] [ 114.491828][ T5847] BUG: Bad page state in process syz.0.17 pfn:759e8 [ 114.766003][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759e8280 pfn:0x759e8 [ 114.776151][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 114.783306][ T5847] page_type: f9(unknown) [ 114.787584][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 114.796272][ T5847] raw: ffff8880759e8280 0000000000000001 00000000f9000000 0000000000000000 [ 114.804914][ T5847] page dumped because: page_pool leak [ 114.810341][ T5847] page_owner tracks the page as allocated [ 114.816074][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438678454, free_ts 112280085534 [ 114.833011][ T5847] post_alloc_hook+0x231/0x280 [ 114.837813][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 114.843427][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 114.849289][ T5847] __alloc_pages_noprof+0x10/0x100 [ 114.854421][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 114.859971][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 114.866074][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 114.871032][ T5847] do_xdp_generic+0x76b/0x12e0 [ 114.875849][ T5847] tun_get_user+0x24ca/0x43e0 [ 114.880592][ T5847] tun_chr_write_iter+0x113/0x200 [ 114.885658][ T5847] vfs_write+0x61d/0xb90 [ 114.889998][ T5847] ksys_write+0x150/0x270 [ 114.894362][ T5847] do_syscall_64+0x15f/0xf80 [ 114.899020][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.904937][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 114.911315][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 114.916461][ T5847] rcu_core+0x7cd/0x1070 [ 114.920806][ T5847] handle_softirqs+0x22a/0x840 [ 114.925595][ T5847] __irq_exit_rcu+0xca/0x220 [ 114.930244][ T5847] irq_exit_rcu+0x9/0x30 [ 114.934511][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 114.940204][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.946216][ T5847] Modules linked in: [ 114.950193][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 114.950221][ T5847] Tainted: [B]=BAD_PAGE [ 114.950229][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 114.950241][ T5847] Call Trace: [ 114.950248][ T5847] [ 114.950256][ T5847] dump_stack_lvl+0xe8/0x150 [ 114.950282][ T5847] bad_page+0x17f/0x1c0 [ 114.950310][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 114.950341][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 114.950373][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 114.950391][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 114.950437][ T5847] do_xdp_generic+0xac5/0x12e0 [ 114.950456][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.950483][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 114.950509][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.950545][ T5847] ? tun_get_user+0x2394/0x43e0 [ 114.950571][ T5847] tun_get_user+0x24ca/0x43e0 [ 114.950607][ T5847] ? aa_file_perm+0x192/0x15e0 [ 114.950640][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 114.950669][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 114.950697][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 114.950760][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 114.950790][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 114.950819][ T5847] ? tun_get+0x1c/0x2f0 [ 114.950843][ T5847] ? tun_get+0x1c/0x2f0 [ 114.950869][ T5847] ? tun_get+0x1c/0x2f0 [ 114.950891][ T5847] ? tun_get+0x1c/0x2f0 [ 114.950917][ T5847] tun_chr_write_iter+0x113/0x200 [ 114.950945][ T5847] vfs_write+0x61d/0xb90 [ 114.950979][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 114.951009][ T5847] ? __pfx_do_futex+0x10/0x10 [ 114.951041][ T5847] ksys_write+0x150/0x270 [ 114.951072][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 114.951105][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.951127][ T5847] do_syscall_64+0x15f/0xf80 [ 114.951157][ T5847] ? trace_irq_disable+0x3b/0x140 [ 114.951188][ T5847] ? clear_bhb_loop+0x40/0x90 [ 114.951212][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.951233][ T5847] RIP: 0033:0x7f58e5f5d60e [ 114.951252][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.951270][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.951291][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 114.951307][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 114.951321][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 114.951334][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.951346][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 114.951370][ T5847] [ 114.951382][ T5847] BUG: Bad page state in process syz.0.17 pfn:759f4 [ 115.225466][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759f4140 pfn:0x759f4 [ 115.235591][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 115.242748][ T5847] page_type: f9(unknown) [ 115.246992][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 115.255645][ T5847] raw: ffff8880759f4140 0000000000000001 00000000f9000000 0000000000000000 [ 115.264263][ T5847] page dumped because: page_pool leak [ 115.269701][ T5847] page_owner tracks the page as allocated [ 115.275437][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438661636, free_ts 112280146890 [ 115.292340][ T5847] post_alloc_hook+0x231/0x280 [ 115.297158][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 115.302774][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 115.308662][ T5847] __alloc_pages_noprof+0x10/0x100 [ 115.313809][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 115.319332][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 115.325434][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 115.330349][ T5847] do_xdp_generic+0x76b/0x12e0 [ 115.335136][ T5847] tun_get_user+0x24ca/0x43e0 [ 115.339870][ T5847] tun_chr_write_iter+0x113/0x200 [ 115.344921][ T5847] vfs_write+0x61d/0xb90 [ 115.349222][ T5847] ksys_write+0x150/0x270 [ 115.353589][ T5847] do_syscall_64+0x15f/0xf80 [ 115.358195][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.364172][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 115.370604][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 115.375760][ T5847] rcu_core+0x7cd/0x1070 [ 115.380061][ T5847] handle_softirqs+0x22a/0x840 [ 115.384854][ T5847] __irq_exit_rcu+0xca/0x220 [ 115.389521][ T5847] irq_exit_rcu+0x9/0x30 [ 115.393825][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 115.399528][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 115.405568][ T5847] Modules linked in: [ 115.409530][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 115.409558][ T5847] Tainted: [B]=BAD_PAGE [ 115.409564][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 115.409576][ T5847] Call Trace: [ 115.409583][ T5847] [ 115.409591][ T5847] dump_stack_lvl+0xe8/0x150 [ 115.409616][ T5847] bad_page+0x17f/0x1c0 [ 115.409643][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 115.409672][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 115.409703][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 115.409723][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 115.409779][ T5847] do_xdp_generic+0xac5/0x12e0 [ 115.409799][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 115.409827][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 115.409851][ T5847] ? tun_get_user+0x2394/0x43e0 [ 115.409886][ T5847] ? tun_get_user+0x2394/0x43e0 [ 115.409911][ T5847] tun_get_user+0x24ca/0x43e0 [ 115.409945][ T5847] ? aa_file_perm+0x192/0x15e0 [ 115.409978][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 115.410006][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 115.410033][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 115.410062][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 115.410092][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 115.410122][ T5847] ? tun_get+0x1c/0x2f0 [ 115.410147][ T5847] ? tun_get+0x1c/0x2f0 [ 115.410174][ T5847] ? tun_get+0x1c/0x2f0 [ 115.410199][ T5847] ? tun_get+0x1c/0x2f0 [ 115.410225][ T5847] tun_chr_write_iter+0x113/0x200 [ 115.410253][ T5847] vfs_write+0x61d/0xb90 [ 115.410288][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 115.410318][ T5847] ? __pfx_do_futex+0x10/0x10 [ 115.410350][ T5847] ksys_write+0x150/0x270 [ 115.410379][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 115.410412][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.410434][ T5847] do_syscall_64+0x15f/0xf80 [ 115.410464][ T5847] ? trace_irq_disable+0x3b/0x140 [ 115.410495][ T5847] ? clear_bhb_loop+0x40/0x90 [ 115.410519][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.410540][ T5847] RIP: 0033:0x7f58e5f5d60e [ 115.410559][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.410577][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.410599][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 115.410615][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 115.410628][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 115.410641][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.410654][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 115.410678][ T5847] [ 115.410689][ T5847] BUG: Bad page state in process syz.0.17 pfn:759db [ 115.685152][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759db000 pfn:0x759db [ 115.695326][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 115.702513][ T5847] page_type: f9(unknown) [ 115.706762][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 115.715409][ T5847] raw: ffff8880759db000 0000000000000001 00000000f9000000 0000000000000000 [ 115.724039][ T5847] page dumped because: page_pool leak [ 115.729467][ T5847] page_owner tracks the page as allocated [ 115.735201][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438645652, free_ts 112280208165 [ 115.752117][ T5847] post_alloc_hook+0x231/0x280 [ 115.756944][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 115.762576][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 115.768439][ T5847] __alloc_pages_noprof+0x10/0x100 [ 115.773580][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 115.779100][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 115.785196][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 115.790113][ T5847] do_xdp_generic+0x76b/0x12e0 [ 115.794900][ T5847] tun_get_user+0x24ca/0x43e0 [ 115.799640][ T5847] tun_chr_write_iter+0x113/0x200 [ 115.804693][ T5847] vfs_write+0x61d/0xb90 [ 115.809030][ T5847] ksys_write+0x150/0x270 [ 115.813400][ T5847] do_syscall_64+0x15f/0xf80 [ 115.818014][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.824079][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 115.830448][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 115.835571][ T5847] rcu_core+0x7cd/0x1070 [ 115.839874][ T5847] handle_softirqs+0x22a/0x840 [ 115.844700][ T5847] __irq_exit_rcu+0xca/0x220 [ 115.849388][ T5847] irq_exit_rcu+0x9/0x30 [ 115.853656][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 115.859358][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 115.865359][ T5847] Modules linked in: [ 115.869318][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 115.869346][ T5847] Tainted: [B]=BAD_PAGE [ 115.869353][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 115.869365][ T5847] Call Trace: [ 115.869373][ T5847] [ 115.869381][ T5847] dump_stack_lvl+0xe8/0x150 [ 115.869407][ T5847] bad_page+0x17f/0x1c0 [ 115.869434][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 115.869466][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 115.869499][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 115.869518][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 115.869567][ T5847] do_xdp_generic+0xac5/0x12e0 [ 115.869586][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 115.869614][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 115.869636][ T5847] ? tun_get_user+0x2394/0x43e0 [ 115.869670][ T5847] ? tun_get_user+0x2394/0x43e0 [ 115.869695][ T5847] tun_get_user+0x24ca/0x43e0 [ 115.869739][ T5847] ? aa_file_perm+0x192/0x15e0 [ 115.869772][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 115.869800][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 115.869828][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 115.869857][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 115.869887][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 115.869917][ T5847] ? tun_get+0x1c/0x2f0 [ 115.869941][ T5847] ? tun_get+0x1c/0x2f0 [ 115.869967][ T5847] ? tun_get+0x1c/0x2f0 [ 115.869990][ T5847] ? tun_get+0x1c/0x2f0 [ 115.870016][ T5847] tun_chr_write_iter+0x113/0x200 [ 115.870044][ T5847] vfs_write+0x61d/0xb90 [ 115.870077][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 115.870107][ T5847] ? __pfx_do_futex+0x10/0x10 [ 115.870140][ T5847] ksys_write+0x150/0x270 [ 115.870170][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 115.870204][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.870226][ T5847] do_syscall_64+0x15f/0xf80 [ 115.870255][ T5847] ? trace_irq_disable+0x3b/0x140 [ 115.870286][ T5847] ? clear_bhb_loop+0x40/0x90 [ 115.870310][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.870331][ T5847] RIP: 0033:0x7f58e5f5d60e [ 115.870349][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.870367][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.870389][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 115.870405][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 115.870418][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 115.870431][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.870444][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 115.870468][ T5847] [ 115.870480][ T5847] BUG: Bad page state in process syz.0.17 pfn:759d8 [ 116.144719][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759d8000 pfn:0x759d8 [ 116.154844][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 116.162016][ T5847] page_type: f9(unknown) [ 116.166266][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 116.174911][ T5847] raw: ffff8880759d8000 0000000000000001 00000000f9000000 0000000000000000 [ 116.183576][ T5847] page dumped because: page_pool leak [ 116.189061][ T5847] page_owner tracks the page as allocated [ 116.194798][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438629813, free_ts 112280226200 [ 116.211752][ T5847] post_alloc_hook+0x231/0x280 [ 116.216556][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 116.222205][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 116.228050][ T5847] __alloc_pages_noprof+0x10/0x100 [ 116.233246][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 116.238780][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 116.244881][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 116.249795][ T5847] do_xdp_generic+0x76b/0x12e0 [ 116.254587][ T5847] tun_get_user+0x24ca/0x43e0 [ 116.259333][ T5847] tun_chr_write_iter+0x113/0x200 [ 116.264388][ T5847] vfs_write+0x61d/0xb90 [ 116.268705][ T5847] ksys_write+0x150/0x270 [ 116.273070][ T5847] do_syscall_64+0x15f/0xf80 [ 116.277672][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.283662][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 116.290075][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 116.295210][ T5847] rcu_core+0x7cd/0x1070 [ 116.299523][ T5847] handle_softirqs+0x22a/0x840 [ 116.304328][ T5847] __irq_exit_rcu+0xca/0x220 [ 116.308971][ T5847] irq_exit_rcu+0x9/0x30 [ 116.313244][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 116.318954][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 116.324969][ T5847] Modules linked in: [ 116.328934][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 116.328961][ T5847] Tainted: [B]=BAD_PAGE [ 116.328968][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 116.328981][ T5847] Call Trace: [ 116.328988][ T5847] [ 116.328996][ T5847] dump_stack_lvl+0xe8/0x150 [ 116.329020][ T5847] bad_page+0x17f/0x1c0 [ 116.329047][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 116.329077][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 116.329108][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 116.329128][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 116.329177][ T5847] do_xdp_generic+0xac5/0x12e0 [ 116.329197][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 116.329224][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 116.329249][ T5847] ? tun_get_user+0x2394/0x43e0 [ 116.329284][ T5847] ? tun_get_user+0x2394/0x43e0 [ 116.329309][ T5847] tun_get_user+0x24ca/0x43e0 [ 116.329343][ T5847] ? aa_file_perm+0x192/0x15e0 [ 116.329375][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 116.329404][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 116.329431][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 116.329460][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 116.329491][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 116.329520][ T5847] ? tun_get+0x1c/0x2f0 [ 116.329545][ T5847] ? tun_get+0x1c/0x2f0 [ 116.329582][ T5847] ? tun_get+0x1c/0x2f0 [ 116.329607][ T5847] ? tun_get+0x1c/0x2f0 [ 116.329634][ T5847] tun_chr_write_iter+0x113/0x200 [ 116.329662][ T5847] vfs_write+0x61d/0xb90 [ 116.329695][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 116.329726][ T5847] ? __pfx_do_futex+0x10/0x10 [ 116.329759][ T5847] ksys_write+0x150/0x270 [ 116.329789][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 116.329823][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.329844][ T5847] do_syscall_64+0x15f/0xf80 [ 116.329871][ T5847] ? trace_irq_disable+0x3b/0x140 [ 116.329911][ T5847] ? clear_bhb_loop+0x40/0x90 [ 116.329935][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.329956][ T5847] RIP: 0033:0x7f58e5f5d60e [ 116.329974][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 116.329992][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 116.330014][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 116.330030][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 116.330044][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 116.330057][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.330071][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 116.330095][ T5847] [ 116.330106][ T5847] BUG: Bad page state in process syz.0.17 pfn:759d7 [ 116.558515][ T50] Bluetooth: hci0: command tx timeout [ 116.562416][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759d7000 pfn:0x759d7 [ 116.619595][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 116.626714][ T5847] page_type: f9(unknown) [ 116.631015][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 116.639660][ T5847] raw: ffff8880759d7000 0000000000000001 00000000f9000000 0000000000000000 [ 116.648315][ T5847] page dumped because: page_pool leak [ 116.653729][ T5847] page_owner tracks the page as allocated [ 116.659504][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438614406, free_ts 112280311815 [ 116.676395][ T5847] post_alloc_hook+0x231/0x280 [ 116.681211][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 116.686792][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 116.692674][ T5847] __alloc_pages_noprof+0x10/0x100 [ 116.697842][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 116.703371][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 116.709483][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 116.714362][ T5847] do_xdp_generic+0x76b/0x12e0 [ 116.719184][ T5847] tun_get_user+0x24ca/0x43e0 [ 116.723893][ T5847] tun_chr_write_iter+0x113/0x200 [ 116.728973][ T5847] vfs_write+0x61d/0xb90 [ 116.733248][ T5847] ksys_write+0x150/0x270 [ 116.737586][ T5847] do_syscall_64+0x15f/0xf80 [ 116.742245][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.748163][ T5847] page last free pid 5761 tgid 5761 stack trace: [ 116.754544][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 116.759709][ T5847] rcu_core+0x7cd/0x1070 [ 116.763986][ T5847] handle_softirqs+0x22a/0x840 [ 116.768801][ T5847] __irq_exit_rcu+0xca/0x220 [ 116.773418][ T5847] irq_exit_rcu+0x9/0x30 [ 116.777672][ T5847] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 116.783382][ T5847] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 116.789415][ T5847] Modules linked in: [ 116.793323][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 116.793343][ T5847] Tainted: [B]=BAD_PAGE [ 116.793348][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 116.793358][ T5847] Call Trace: [ 116.793365][ T5847] [ 116.793371][ T5847] dump_stack_lvl+0xe8/0x150 [ 116.793391][ T5847] bad_page+0x17f/0x1c0 [ 116.793410][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 116.793432][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 116.793455][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 116.793468][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 116.793501][ T5847] do_xdp_generic+0xac5/0x12e0 [ 116.793514][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 116.793533][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 116.793550][ T5847] ? tun_get_user+0x2394/0x43e0 [ 116.793574][ T5847] ? tun_get_user+0x2394/0x43e0 [ 116.793591][ T5847] tun_get_user+0x24ca/0x43e0 [ 116.793614][ T5847] ? aa_file_perm+0x192/0x15e0 [ 116.793643][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 116.793663][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 116.793681][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 116.793701][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 116.793722][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 116.793743][ T5847] ? tun_get+0x1c/0x2f0 [ 116.793760][ T5847] ? tun_get+0x1c/0x2f0 [ 116.793778][ T5847] ? tun_get+0x1c/0x2f0 [ 116.793795][ T5847] ? tun_get+0x1c/0x2f0 [ 116.793813][ T5847] tun_chr_write_iter+0x113/0x200 [ 116.793833][ T5847] vfs_write+0x61d/0xb90 [ 116.793857][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 116.793878][ T5847] ? __pfx_do_futex+0x10/0x10 [ 116.793900][ T5847] ksys_write+0x150/0x270 [ 116.793922][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 116.793945][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.793960][ T5847] do_syscall_64+0x15f/0xf80 [ 116.793981][ T5847] ? trace_irq_disable+0x3b/0x140 [ 116.794002][ T5847] ? clear_bhb_loop+0x40/0x90 [ 116.794018][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.794032][ T5847] RIP: 0033:0x7f58e5f5d60e [ 116.794046][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 116.794059][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 116.794074][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 116.794085][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 116.794095][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 116.794104][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.794112][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 116.794129][ T5847] [ 116.794138][ T5847] BUG: Bad page state in process syz.0.17 pfn:759dd [ 117.068859][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759dd000 pfn:0x759dd [ 117.079009][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 117.086163][ T5847] page_type: f9(unknown) [ 117.090526][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 117.099228][ T5847] raw: ffff8880759dd000 0000000000000001 00000000f9000000 0000000000000000 [ 117.107819][ T5847] page dumped because: page_pool leak [ 117.113275][ T5847] page_owner tracks the page as allocated [ 117.119036][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438598564, free_ts 112280359096 [ 117.135983][ T5847] post_alloc_hook+0x231/0x280 [ 117.140806][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 117.146457][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 117.152325][ T5847] __alloc_pages_noprof+0x10/0x100 [ 117.157475][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 117.163037][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 117.169165][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 117.174031][ T5847] do_xdp_generic+0x76b/0x12e0 [ 117.178873][ T5847] tun_get_user+0x24ca/0x43e0 [ 117.183585][ T5847] tun_chr_write_iter+0x113/0x200 [ 117.188732][ T5847] vfs_write+0x61d/0xb90 [ 117.193010][ T5847] ksys_write+0x150/0x270 [ 117.197362][ T5847] do_syscall_64+0x15f/0xf80 [ 117.202038][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.207963][ T5847] page last free pid 15 tgid 15 stack trace: [ 117.214033][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 117.219205][ T5847] rcu_core+0x7cd/0x1070 [ 117.223459][ T5847] handle_softirqs+0x22a/0x840 [ 117.228217][ T5847] run_ksoftirqd+0x36/0x60 [ 117.232728][ T5847] smpboot_thread_fn+0x541/0xa50 [ 117.237694][ T5847] kthread+0x388/0x470 [ 117.241889][ T5847] ret_from_fork+0x514/0xb70 [ 117.246528][ T5847] ret_from_fork_asm+0x1a/0x30 [ 117.251374][ T5847] Modules linked in: [ 117.255300][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 117.255323][ T5847] Tainted: [B]=BAD_PAGE [ 117.255328][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 117.255337][ T5847] Call Trace: [ 117.255344][ T5847] [ 117.255350][ T5847] dump_stack_lvl+0xe8/0x150 [ 117.255369][ T5847] bad_page+0x17f/0x1c0 [ 117.255389][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 117.255411][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 117.255434][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 117.255447][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 117.255482][ T5847] do_xdp_generic+0xac5/0x12e0 [ 117.255495][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 117.255514][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 117.255531][ T5847] ? tun_get_user+0x2394/0x43e0 [ 117.255555][ T5847] ? tun_get_user+0x2394/0x43e0 [ 117.255572][ T5847] tun_get_user+0x24ca/0x43e0 [ 117.255595][ T5847] ? aa_file_perm+0x192/0x15e0 [ 117.255623][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 117.255643][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 117.255662][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 117.255681][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 117.255702][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 117.255723][ T5847] ? tun_get+0x1c/0x2f0 [ 117.255740][ T5847] ? tun_get+0x1c/0x2f0 [ 117.255759][ T5847] ? tun_get+0x1c/0x2f0 [ 117.255776][ T5847] ? tun_get+0x1c/0x2f0 [ 117.255795][ T5847] tun_chr_write_iter+0x113/0x200 [ 117.255814][ T5847] vfs_write+0x61d/0xb90 [ 117.255838][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 117.255859][ T5847] ? __pfx_do_futex+0x10/0x10 [ 117.255882][ T5847] ksys_write+0x150/0x270 [ 117.255903][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 117.255927][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.255942][ T5847] do_syscall_64+0x15f/0xf80 [ 117.255970][ T5847] ? trace_irq_disable+0x3b/0x140 [ 117.255992][ T5847] ? clear_bhb_loop+0x40/0x90 [ 117.256008][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.256023][ T5847] RIP: 0033:0x7f58e5f5d60e [ 117.256036][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 117.256049][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.256065][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 117.256076][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 117.256086][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 117.256095][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.256103][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 117.256120][ T5847] [ 117.256129][ T5847] BUG: Bad page state in process syz.0.17 pfn:759ea [ 117.530156][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880759ea000 pfn:0x759ea [ 117.540275][ T5847] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 117.547417][ T5847] page_type: f9(unknown) [ 117.551735][ T5847] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 117.560359][ T5847] raw: ffff8880759ea000 0000000000000001 00000000f9000000 0000000000000000 [ 117.568999][ T5847] page dumped because: page_pool leak [ 117.574385][ T5847] page_owner tracks the page as allocated [ 117.580238][ T5847] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438583286, free_ts 112280375441 [ 117.597230][ T5847] post_alloc_hook+0x231/0x280 [ 117.602080][ T5847] get_page_from_freelist+0x24ba/0x2540 [ 117.607666][ T5847] __alloc_frozen_pages_noprof+0x18d/0x380 [ 117.613548][ T5847] __alloc_pages_noprof+0x10/0x100 [ 117.618731][ T5847] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 117.624203][ T5847] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 117.630334][ T5847] skb_pp_cow_data+0xc91/0x19b0 [ 117.635213][ T5847] do_xdp_generic+0x76b/0x12e0 [ 117.640035][ T5847] tun_get_user+0x24ca/0x43e0 [ 117.645041][ T5847] tun_chr_write_iter+0x113/0x200 [ 117.650148][ T5847] vfs_write+0x61d/0xb90 [ 117.654510][ T5847] ksys_write+0x150/0x270 [ 117.658907][ T5847] do_syscall_64+0x15f/0xf80 [ 117.663530][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.669483][ T5847] page last free pid 15 tgid 15 stack trace: [ 117.675482][ T5847] __free_frozen_pages+0xbc7/0xd30 [ 117.680669][ T5847] rcu_core+0x7cd/0x1070 [ 117.684933][ T5847] handle_softirqs+0x22a/0x840 [ 117.689751][ T5847] run_ksoftirqd+0x36/0x60 [ 117.694193][ T5847] smpboot_thread_fn+0x541/0xa50 [ 117.699186][ T5847] kthread+0x388/0x470 [ 117.703284][ T5847] ret_from_fork+0x514/0xb70 [ 117.707876][ T5847] ret_from_fork_asm+0x1a/0x30 [ 117.712713][ T5847] Modules linked in: [ 117.716647][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 117.716668][ T5847] Tainted: [B]=BAD_PAGE [ 117.716674][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 117.716683][ T5847] Call Trace: [ 117.716690][ T5847] [ 117.716695][ T5847] dump_stack_lvl+0xe8/0x150 [ 117.716714][ T5847] bad_page+0x17f/0x1c0 [ 117.716733][ T5847] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 117.716756][ T5847] bpf_xdp_adjust_tail+0x1d6/0x220 [ 117.716778][ T5847] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 117.716791][ T5847] bpf_prog_run_generic_xdp+0x603/0x1490 [ 117.716825][ T5847] do_xdp_generic+0xac5/0x12e0 [ 117.716839][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 117.716858][ T5847] ? __pfx_do_xdp_generic+0x10/0x10 [ 117.716881][ T5847] ? tun_get_user+0x2394/0x43e0 [ 117.716905][ T5847] ? tun_get_user+0x2394/0x43e0 [ 117.716922][ T5847] tun_get_user+0x24ca/0x43e0 [ 117.716946][ T5847] ? aa_file_perm+0x192/0x15e0 [ 117.716968][ T5847] ? aa_file_perm+0x50e/0x15e0 [ 117.716988][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 117.717006][ T5847] ? __lock_acquire+0x6b5/0x2cf0 [ 117.717026][ T5847] ? ref_tracker_alloc+0x35c/0x4c0 [ 117.717047][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 117.717066][ T5847] ? tun_get+0x1c/0x2f0 [ 117.717083][ T5847] ? tun_get+0x1c/0x2f0 [ 117.717102][ T5847] ? tun_get+0x1c/0x2f0 [ 117.717120][ T5847] ? tun_get+0x1c/0x2f0 [ 117.717139][ T5847] tun_chr_write_iter+0x113/0x200 [ 117.717158][ T5847] vfs_write+0x61d/0xb90 [ 117.717182][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 117.717203][ T5847] ? __pfx_do_futex+0x10/0x10 [ 117.717226][ T5847] ksys_write+0x150/0x270 [ 117.717248][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 117.717271][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.717286][ T5847] do_syscall_64+0x15f/0xf80 [ 117.717308][ T5847] ? trace_irq_disable+0x3b/0x140 [ 117.717330][ T5847] ? clear_bhb_loop+0x40/0x90 [ 117.717346][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.717361][ T5847] RIP: 0033:0x7f58e5f5d60e [ 117.717374][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 117.717386][ T5847] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.717402][ T5847] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 117.717413][ T5847] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 117.717422][ T5847] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 117.717431][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.717440][ T5847] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 117.717457][ T5847] 2026/05/12 07:11:12 executed programs: 3 [ 118.035126][ T5850] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034b1e000 pfn:0x34b1e [ 118.045311][ T5850] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 118.052518][ T5850] page_type: f9(unknown) [ 118.056826][ T5850] raw: 00fff00000000000 0000000000000000 ffff88801af50000 0000000000000000 [ 118.065486][ T5850] raw: ffff888034b1e000 3fffffffffffffff 00000000f9000000 0000000000000000 [ 118.074198][ T5850] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 118.081983][ T5850] page_owner tracks the page as allocated [ 118.087706][ T5850] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5847, tgid 5847 (syz.0.17), ts 112438777874, free_ts 112265589849 [ 118.104624][ T5850] post_alloc_hook+0x231/0x280 [ 118.109449][ T5850] get_page_from_freelist+0x24ba/0x2540 [ 118.115015][ T5850] __alloc_frozen_pages_noprof+0x18d/0x380 [ 118.120889][ T5850] __alloc_pages_noprof+0x10/0x100 [ 118.126038][ T5850] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 118.131598][ T5850] __page_pool_alloc_netmems_slow+0x151/0x7b0 [ 118.137692][ T5850] page_pool_alloc_frag_netmem+0x421/0x9b0 [ 118.143566][ T5850] skb_pp_cow_data+0xcb7/0x19b0 [ 118.148479][ T5850] do_xdp_generic+0x76b/0x12e0 [ 118.153269][ T5850] tun_get_user+0x24ca/0x43e0 [ 118.157981][ T5850] tun_chr_write_iter+0x113/0x200 [ 118.163072][ T5850] vfs_write+0x61d/0xb90 [ 118.167353][ T5850] ksys_write+0x150/0x270 [ 118.171759][ T5850] do_syscall_64+0x15f/0xf80 [ 118.176574][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.182571][ T5850] page last free pid 15 tgid 15 stack trace: [ 118.188604][ T5850] __free_frozen_pages+0xbc7/0xd30 [ 118.193773][ T5850] tlb_remove_table_rcu+0x85/0x100 [ 118.198961][ T5850] rcu_core+0x7cd/0x1070 [ 118.203243][ T5850] handle_softirqs+0x22a/0x840 [ 118.208026][ T5850] run_ksoftirqd+0x36/0x60 [ 118.212526][ T5850] smpboot_thread_fn+0x541/0xa50 [ 118.217501][ T5850] kthread+0x388/0x470 [ 118.221638][ T5850] ret_from_fork+0x514/0xb70 [ 118.226258][ T5850] ret_from_fork_asm+0x1a/0x30 [ 118.231499][ T5850] ------------[ cut here ]------------ [ 118.236972][ T5850] kernel BUG at ./include/linux/mm.h:1766! [ 118.242862][ T5850] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 118.249137][ T5850] CPU: 0 UID: 0 PID: 5850 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT(full) [ 118.259822][ T5850] Tainted: [B]=BAD_PAGE [ 118.263978][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 118.274040][ T5850] RIP: 0010:page_frag_free+0x153/0x160 [ 118.279543][ T5850] Code: 38 c1 0f 8c 74 ff ff ff 4c 89 f7 e8 57 d0 0c 00 e9 67 ff ff ff e8 0d 95 a1 ff 48 89 df 48 c7 c6 60 e3 da 8b e8 9e e3 03 ff 90 <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 118.299192][ T5850] RSP: 0018:ffffc90002f5f468 EFLAGS: 00010246 [ 118.305331][ T5850] RAX: 9f2d834d7172e200 RBX: ffffea0000d2c780 RCX: 0000000000000201 [ 118.313314][ T5850] RDX: 0000000000000000 RSI: ffffffff8c28adc0 RDI: ffff888031c45c40 [ 118.321297][ T5850] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 118.329303][ T5850] R10: dffffc0000000000 R11: fffffbfff1cfd250 R12: ffffea0000000000 [ 118.337280][ T5850] R13: 000000000000bcdd R14: ffffea0000d2c7b4 R15: dffffc0000000000 [ 118.345258][ T5850] FS: 0000555568bf4500(0000) GS:ffff88812528d000(0000) knlGS:0000000000000000 [ 118.354191][ T5850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.360778][ T5850] CR2: 0000200000011000 CR3: 00000000760de000 CR4: 00000000003526f0 [ 118.368774][ T5850] Call Trace: [ 118.372076][ T5850] [ 118.375042][ T5850] bpf_xdp_frags_shrink_tail+0x4da/0x7d0 [ 118.380702][ T5850] bpf_xdp_adjust_tail+0x1d6/0x220 [ 118.385832][ T5850] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 118.391304][ T5850] bpf_prog_run_generic_xdp+0x603/0x1490 [ 118.396983][ T5850] ? lock_release+0x4b/0x3c0 [ 118.401597][ T5850] do_xdp_generic+0xac5/0x12e0 [ 118.406384][ T5850] ? __pfx_do_xdp_generic+0x10/0x10 [ 118.411610][ T5850] ? tun_get_user+0x2394/0x43e0 [ 118.416489][ T5850] tun_get_user+0x24ca/0x43e0 [ 118.421213][ T5850] ? rcu_is_watching+0x15/0xb0 [ 118.426015][ T5850] ? __lock_acquire+0x2c50/0x2cf0 [ 118.431081][ T5850] ? aa_file_perm+0x50e/0x15e0 [ 118.435862][ T5850] ? __pfx_tun_get_user+0x10/0x10 [ 118.440915][ T5850] ? aa_file_perm+0x192/0x15e0 [ 118.445690][ T5850] ? get_futex_key+0x864/0x1590 [ 118.450550][ T5850] ? ref_tracker_alloc+0x35c/0x4c0 [ 118.455670][ T5850] ? rcu_is_watching+0x15/0xb0 [ 118.460443][ T5850] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 118.465981][ T5850] ? __futex_hash+0x33b/0x760 [ 118.470664][ T5850] ? tun_get+0x1c/0x2f0 [ 118.474824][ T5850] ? tun_get+0x1c/0x2f0 [ 118.478986][ T5850] ? rcu_is_watching+0x15/0xb0 [ 118.483780][ T5850] ? tun_get+0x1c/0x2f0 [ 118.487948][ T5850] ? lock_release+0x4b/0x3c0 [ 118.492545][ T5850] ? apparmor_file_permission+0x1f4/0x300 [ 118.498285][ T5850] ? tun_get+0x1c/0x2f0 [ 118.502482][ T5850] tun_chr_write_iter+0x113/0x200 [ 118.507528][ T5850] vfs_write+0x61d/0xb90 [ 118.511799][ T5850] ? __pfx_vfs_write+0x10/0x10 [ 118.516579][ T5850] ? __pfx_do_futex+0x10/0x10 [ 118.521273][ T5850] ksys_write+0x150/0x270 [ 118.525623][ T5850] ? __pfx_ksys_write+0x10/0x10 [ 118.530493][ T5850] ? rcu_is_watching+0x15/0xb0 [ 118.535400][ T5850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.541495][ T5850] do_syscall_64+0x15f/0xf80 [ 118.546112][ T5850] ? clear_bhb_loop+0x40/0x90 [ 118.550800][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.556694][ T5850] RIP: 0033:0x7f58e5f5d60e [ 118.561107][ T5850] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 118.580716][ T5850] RSP: 002b:00007ffdf21d6048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 118.589136][ T5850] RAX: ffffffffffffffda RBX: 0000555568bf4500 RCX: 00007f58e5f5d60e [ 118.597126][ T5850] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 118.605099][ T5850] RBP: 00007f58e6032d69 R08: 0000000000000000 R09: 0000000000000000 [ 118.613075][ T5850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.621053][ T5850] R13: 00007f58e6215fac R14: 00007f58e6215fa0 R15: 00007f58e6215fa0 [ 118.629040][ T5850] [ 118.632059][ T5850] Modules linked in: [ 118.636059][ T5850] ---[ end trace 0000000000000000 ]--- [ 118.641585][ T5850] RIP: 0010:page_frag_free+0x153/0x160 [ 118.647093][ T5850] Code: 38 c1 0f 8c 74 ff ff ff 4c 89 f7 e8 57 d0 0c 00 e9 67 ff ff ff e8 0d 95 a1 ff 48 89 df 48 c7 c6 60 e3 da 8b e8 9e e3 03 ff 90 <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 118.666749][ T5850] RSP: 0018:ffffc90002f5f468 EFLAGS: 00010246 [ 118.672874][ T5850] RAX: 9f2d834d7172e200 RBX: ffffea0000d2c780 RCX: 0000000000000201 [ 118.680892][ T5850] RDX: 0000000000000000 RSI: ffffffff8c28adc0 RDI: ffff888031c45c40 [ 118.688922][ T5850] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 118.696916][ T5850] R10: dffffc0000000000 R11: fffffbfff1cfd250 R12: ffffea0000000000 [ 118.704942][ T5850] R13: 000000000000bcdd R14: ffffea0000d2c7b4 R15: dffffc0000000000 [ 118.712956][ T5850] FS: 0000555568bf4500(0000) GS:ffff88812528d000(0000) knlGS:0000000000000000 [ 118.721971][ T5850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.728616][ T5850] CR2: 0000200000011000 CR3: 00000000760de000 CR4: 00000000003526f0 [ 118.736604][ T5850] Kernel panic - not syncing: Fatal exception in interrupt [ 118.744406][ T5850] Kernel Offset: disabled [ 118.748738][ T5850] Rebooting in 86400 seconds..