BUG: Bad page state in process syz.2.1019 pfn:23651
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023651dc0 pfn:0x23651
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888023651dc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199369817, free_ts 159047152339
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:23650
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023650dc0 pfn:0x23650
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888023650dc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199351380, free_ts 159047169903
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:30bef
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888030befdc0 pfn:0x30bef
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888030befdc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199325525, free_ts 159047186512
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:30bee
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888030beedc0 pfn:0x30bee
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888030beedc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199308557, free_ts 159047203550
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:30bed
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888030beddc0 pfn:0x30bed
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888030beddc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199291697, free_ts 159047220941
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:57a5e
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057a5edc0 pfn:0x57a5e
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888057a5edc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199274343, free_ts 159047276599
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:57a5b
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057a5bdc0 pfn:0x57a5b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888057a5bdc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199256783, free_ts 159047294153
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:57a5a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057a5adc0 pfn:0x57a5a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888057a5adc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199239129, free_ts 159047310295
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:57a59
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057a59dc0 pfn:0x57a59
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888057a59dc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199221051, free_ts 159047327416
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:3151a
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803151adc0 pfn:0x3151a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff88803151adc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199204770, free_ts 159047345204
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298
BUG: Bad page state in process syz.2.1019 pfn:31519
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031519dc0 pfn:0x31519
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880222ac000 0000000000000000
raw: ffff888031519dc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 9358, tgid 9357 (syz.2.1019), ts 162199188357, free_ts 159047362395
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5178
__alloc_pages_noprof mm/page_alloc.c:5212 [inline]
alloc_pages_bulk_noprof+0x560/0x710 mm/page_alloc.c:5132
alloc_pages_bulk_node_noprof include/linux/gfp.h:255 [inline]
__page_pool_alloc_netmems_slow+0x14c/0x710 net/core/page_pool.c:612
page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline]
page_pool_alloc include/net/page_pool/helpers.h:167 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline]
skb_pp_cow_data+0xb47/0x13e0 net/core/skbuff.c:972
netif_skb_check_for_xdp net/core/dev.c:5485 [inline]
netif_receive_generic_xdp net/core/dev.c:5526 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
page last free pid 5839 tgid 5839 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901
discard_slab mm/slub.c:3330 [inline]
__put_partials+0x146/0x170 mm/slub.c:3876
put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3951
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x903/0x1b10 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1541
copy_process+0x1706/0x3c00 kernel/fork.c:2181
kernel_clone+0x21e/0x840 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2734
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 1 UID: 0 PID: 9358 Comm: syz.2.1019 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
bad_page+0x180/0x1c0 mm/page_alloc.c:649
free_page_is_bad mm/page_alloc.c:1082 [inline]
free_pages_prepare mm/page_alloc.c:1386 [inline]
__free_frozen_pages+0xce2/0xd30 mm/page_alloc.c:2901
bpf_xdp_shrink_data net/core/filter.c:4195 [inline]
bpf_xdp_frags_shrink_tail+0x4f7/0x7f0 net/core/filter.c:4219
____bpf_xdp_adjust_tail net/core/filter.c:4241 [inline]
bpf_xdp_adjust_tail+0x1d6/0x220 net/core/filter.c:4234
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:721 [inline]
bpf_prog_run_xdp include/net/xdp.h:696 [inline]
bpf_prog_run_generic_xdp+0x606/0x13d0 net/core/dev.c:5416
netif_receive_generic_xdp net/core/dev.c:5532 [inline]
do_xdp_generic+0x9f7/0x11a0 net/core/dev.c:5594
__netif_receive_skb_core+0x10c6/0x2f90 net/core/dev.c:5947
__netif_receive_skb_one_core net/core/dev.c:6135 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6250
netif_receive_skb_internal net/core/dev.c:6336 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6395
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe67c78e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fe67a9f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe67c9e5fa0 RCX: 00007fe67c78e1ff
RDX: 0000000000011dc0 RSI: 0000200000002940 RDI: 00000000000000c8
RBP: 00007fe67c813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000011dc0 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fe67c9e6038 R14: 00007fe67c9e5fa0 R15: 00007fff20632298