Warning: Permanently added '10.128.1.118' (ED25519) to the list of known hosts. 2026/06/19 10:32:28 parsed 1 programs 2026/06/19 10:32:28 serving rpc on tcp://44717 [ 69.807019][ T5629] cgroup: Unknown subsys name 'net' [ 69.935816][ T5629] cgroup: Unknown subsys name 'cpuset' [ 69.943359][ T5629] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.197533][ T5629] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.274381][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.280749][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.566782][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.574720][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.595888][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.603808][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.630698][ T5647] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 73.996833][ T49] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 74.004234][ T49] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 74.011614][ T49] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 74.019551][ T49] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 74.031269][ T49] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.116864][ T5686] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.124093][ T5686] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.131209][ T5686] bridge_slave_0: entered allmulticast mode [ 75.138013][ T5686] bridge_slave_0: entered promiscuous mode [ 75.148646][ T5686] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.155985][ T5686] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.163089][ T5686] bridge_slave_1: entered allmulticast mode [ 75.169938][ T5686] bridge_slave_1: entered promiscuous mode [ 75.189088][ T5686] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.200309][ T5686] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.221002][ T5686] team0: Port device team_slave_0 added [ 75.228431][ T5686] team0: Port device team_slave_1 added [ 75.245773][ T5686] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.252804][ T5686] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.279054][ T5686] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.290953][ T5686] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.298080][ T5686] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.324459][ T5686] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.353932][ T5686] hsr_slave_0: entered promiscuous mode [ 75.360091][ T5686] hsr_slave_1: entered promiscuous mode [ 75.436684][ T5686] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.445935][ T5686] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.453682][ T5686] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 75.462026][ T5686] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 75.469737][ T5686] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 75.478234][ T5686] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 75.485987][ T5686] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.494648][ T5686] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 75.512934][ T5686] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.520015][ T5686] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.527454][ T5686] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.534610][ T5686] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.570038][ T5686] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.582348][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.590097][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.601755][ T5686] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.612487][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.619610][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.630580][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.637687][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.848611][ T5686] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.881172][ T5686] veth0_vlan: entered promiscuous mode [ 75.890934][ T5686] veth1_vlan: entered promiscuous mode [ 75.909960][ T5686] veth0_macvtap: entered promiscuous mode [ 75.919115][ T5686] veth1_macvtap: entered promiscuous mode [ 75.931767][ T5686] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.943231][ T5686] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.954920][ T35] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.964318][ T35] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.973076][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.983624][ T35] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.065497][ T64] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.127705][ T64] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.172879][ T64] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.225271][ T64] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/06/19 10:32:39 executed programs: 0 [ 76.850201][ T4938] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.858830][ T4938] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.866250][ T4938] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.874315][ T4938] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.881840][ T4938] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.170052][ T5757] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.177306][ T5757] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.185159][ T5757] bridge_slave_0: entered allmulticast mode [ 77.191862][ T5757] bridge_slave_0: entered promiscuous mode [ 77.201212][ T5757] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.208601][ T5757] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.215879][ T5757] bridge_slave_1: entered allmulticast mode [ 77.222519][ T5757] bridge_slave_1: entered promiscuous mode [ 77.242412][ T5757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.253705][ T5757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.275270][ T5757] team0: Port device team_slave_0 added [ 77.282199][ T5757] team0: Port device team_slave_1 added [ 77.301383][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.308469][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.334653][ T5757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.346539][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.353654][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.379874][ T5757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.412655][ T5757] hsr_slave_0: entered promiscuous mode [ 77.418726][ T5757] hsr_slave_1: entered promiscuous mode [ 77.424810][ T5757] debugfs: 'hsr0' already exists in 'hsr' [ 77.430547][ T5757] Cannot create hsr debugfs directory [ 78.953524][ T4938] Bluetooth: hci0: command tx timeout [ 79.087285][ T64] bridge_slave_1: left allmulticast mode [ 79.093273][ T64] bridge_slave_1: left promiscuous mode [ 79.099845][ T64] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.125485][ T64] bridge_slave_0: left allmulticast mode [ 79.131193][ T64] bridge_slave_0: left promiscuous mode [ 79.137089][ T64] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.230120][ T64] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 79.246455][ T64] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 79.256576][ T64] bond0 (unregistering): Released all slaves [ 79.335670][ T64] hsr_slave_0: left promiscuous mode [ 79.341554][ T64] hsr_slave_1: left promiscuous mode [ 79.347655][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 79.355389][ T64] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 79.363139][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 79.370816][ T64] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 79.382901][ T64] veth1_macvtap: left promiscuous mode [ 79.388670][ T64] veth0_macvtap: left promiscuous mode [ 79.394366][ T64] veth1_vlan: left promiscuous mode [ 79.399637][ T64] veth0_vlan: left promiscuous mode [ 79.520429][ T64] team0 (unregistering): Port device team_slave_1 removed [ 79.531978][ T64] team0 (unregistering): Port device team_slave_0 removed [ 79.580208][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1 [ 79.744337][ T5757] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.760159][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.767928][ T5757] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.778454][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.786890][ T5757] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.796009][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.804012][ T5757] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.812710][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.887947][ T5757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.911576][ T5757] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.922852][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.930000][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.943106][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.950371][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.460880][ T5757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.503091][ T5757] veth0_vlan: entered promiscuous mode [ 80.516231][ T5757] veth1_vlan: entered promiscuous mode [ 80.557832][ T5757] veth0_macvtap: entered promiscuous mode [ 80.568001][ T5757] veth1_macvtap: entered promiscuous mode [ 80.585263][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.598261][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.613041][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.634901][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.655876][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.671155][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.690777][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.702802][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.728042][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.736764][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.790770][ T5840] BUG: Bad page state in process syz.0.17 pfn:32920 [ 80.797555][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032920780 pfn:0x32920 [ 80.807712][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 80.814884][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 80.823527][ T5840] raw: ffff888032920780 3fffffffffffffff 00000000ffffffff 0000000000000000 [ 80.832132][ T5840] page dumped because: page_pool leak [ 80.837567][ T5840] page_owner tracks the page as allocated [ 80.843305][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790666706, free_ts 80643877656 [ 80.860056][ T5840] post_alloc_hook+0x22d/0x280 [ 80.864903][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 80.870502][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 80.876410][ T5840] __alloc_pages_noprof+0x10/0x100 [ 80.881573][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 80.887108][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 80.893211][ T5840] page_pool_alloc_frag_netmem+0x563/0x9b0 [ 80.899092][ T5840] skb_pp_cow_data+0xcf6/0x19a0 [ 80.904005][ T5840] do_xdp_generic+0x770/0x12d0 [ 80.908800][ T5840] tun_get_user+0x24a0/0x4350 [ 80.913557][ T5840] tun_chr_write_iter+0x113/0x200 [ 80.918613][ T5840] vfs_write+0x612/0xba0 [ 80.922893][ T5840] ksys_write+0x150/0x270 [ 80.927319][ T5840] do_syscall_64+0x174/0x580 [ 80.931958][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.937925][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 80.944295][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 80.949446][ T5840] rcu_core+0x78b/0x10a0 [ 80.953754][ T5840] handle_softirqs+0x225/0x840 [ 80.958550][ T5840] __irq_exit_rcu+0xca/0x220 [ 80.963174][ T5840] irq_exit_rcu+0x9/0x30 [ 80.967502][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 80.973172][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 80.979241][ T5840] Modules linked in: [ 80.983278][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 80.983303][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 80.983322][ T5840] Call Trace: [ 80.983333][ T5840] [ 80.983341][ T5840] dump_stack_lvl+0xe8/0x150 [ 80.983366][ T5840] bad_page+0x17f/0x1c0 [ 80.983388][ T5840] __free_frozen_pages+0xcca/0xd20 [ 80.983431][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 80.983463][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 80.983494][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 80.983518][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 80.983552][ T5840] do_xdp_generic+0xac2/0x12d0 [ 80.983573][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 80.983597][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 80.983631][ T5840] ? tun_get_user+0x2373/0x4350 [ 80.983656][ T5840] tun_get_user+0x24a0/0x4350 [ 80.983680][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 80.983713][ T5840] ? lock_release+0x4b/0x3c0 [ 80.983746][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 80.983768][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 80.983798][ T5840] ? futex_hash+0x4e/0x2b0 [ 80.983826][ T5840] ? rcu_is_watching+0x15/0xb0 [ 80.983848][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 80.983872][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 80.983895][ T5840] ? tun_get+0x1c/0x2f0 [ 80.983918][ T5840] ? tun_get+0x1c/0x2f0 [ 80.983940][ T5840] ? rcu_is_watching+0x15/0xb0 [ 80.983958][ T5840] ? tun_get+0x1c/0x2f0 [ 80.983980][ T5840] ? lock_release+0x4b/0x3c0 [ 80.984008][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 80.984035][ T5840] ? tun_get+0x1c/0x2f0 [ 80.984060][ T5840] tun_chr_write_iter+0x113/0x200 [ 80.984086][ T5840] vfs_write+0x612/0xba0 [ 80.984116][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 80.984143][ T5840] ? __pfx_do_futex+0x10/0x10 [ 80.984171][ T5840] ksys_write+0x150/0x270 [ 80.984199][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 80.984227][ T5840] ? rcu_is_watching+0x15/0xb0 [ 80.984247][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.984268][ T5840] do_syscall_64+0x174/0x580 [ 80.984294][ T5840] ? trace_irq_disable+0x3b/0x140 [ 80.984321][ T5840] ? clear_bhb_loop+0x40/0x90 [ 80.984344][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.984364][ T5840] RIP: 0033:0x7f980b75d68e [ 80.984398][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 80.984421][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 80.984442][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 80.984456][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 80.984469][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 80.984481][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.984492][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 80.984515][ T5840] [ 81.276323][ T5840] BUG: Bad page state in process syz.0.17 pfn:35169 [ 81.283011][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035169e70 pfn:0x35169 [ 81.293108][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 81.300261][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 81.308871][ T5840] raw: ffff888035169e70 0000000000000001 00000000ffffffff 0000000000000000 [ 81.317497][ T5840] page dumped because: page_pool leak [ 81.322875][ T5840] page_owner tracks the page as allocated [ 81.328626][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790653469, free_ts 80643887621 [ 81.345338][ T5840] post_alloc_hook+0x22d/0x280 [ 81.350116][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 81.355703][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 81.361531][ T5840] __alloc_pages_noprof+0x10/0x100 [ 81.366707][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 81.372190][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 81.378301][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 81.383183][ T5840] do_xdp_generic+0x770/0x12d0 [ 81.388001][ T5840] tun_get_user+0x24a0/0x4350 [ 81.392719][ T5840] tun_chr_write_iter+0x113/0x200 [ 81.397812][ T5840] vfs_write+0x612/0xba0 [ 81.402094][ T5840] ksys_write+0x150/0x270 [ 81.406502][ T5840] do_syscall_64+0x174/0x580 [ 81.411110][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.417046][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 81.423385][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 81.428562][ T5840] rcu_core+0x78b/0x10a0 [ 81.432801][ T5840] handle_softirqs+0x225/0x840 [ 81.437607][ T5840] __irq_exit_rcu+0xca/0x220 [ 81.442214][ T5840] irq_exit_rcu+0x9/0x30 [ 81.446508][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 81.452166][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 81.458191][ T5840] Modules linked in: [ 81.462108][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 81.462128][ T5840] Tainted: [B]=BAD_PAGE [ 81.462133][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.462142][ T5840] Call Trace: [ 81.462147][ T5840] [ 81.462153][ T5840] dump_stack_lvl+0xe8/0x150 [ 81.462170][ T5840] bad_page+0x17f/0x1c0 [ 81.462186][ T5840] __free_frozen_pages+0xcca/0xd20 [ 81.462207][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 81.462230][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 81.462252][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 81.462264][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 81.462288][ T5840] do_xdp_generic+0xac2/0x12d0 [ 81.462302][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 81.462318][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 81.462341][ T5840] ? tun_get_user+0x2373/0x4350 [ 81.462359][ T5840] tun_get_user+0x24a0/0x4350 [ 81.462380][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 81.462404][ T5840] ? lock_release+0x4b/0x3c0 [ 81.462427][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 81.462442][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 81.462464][ T5840] ? futex_hash+0x4e/0x2b0 [ 81.462484][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.462500][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 81.462517][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 81.462533][ T5840] ? tun_get+0x1c/0x2f0 [ 81.462549][ T5840] ? tun_get+0x1c/0x2f0 [ 81.462565][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.462578][ T5840] ? tun_get+0x1c/0x2f0 [ 81.462594][ T5840] ? lock_release+0x4b/0x3c0 [ 81.462614][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 81.462634][ T5840] ? tun_get+0x1c/0x2f0 [ 81.462652][ T5840] tun_chr_write_iter+0x113/0x200 [ 81.462670][ T5840] vfs_write+0x612/0xba0 [ 81.462692][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 81.462711][ T5840] ? __pfx_do_futex+0x10/0x10 [ 81.462731][ T5840] ksys_write+0x150/0x270 [ 81.462773][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 81.462800][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.462830][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.462854][ T5840] do_syscall_64+0x174/0x580 [ 81.462887][ T5840] ? trace_irq_disable+0x3b/0x140 [ 81.462915][ T5840] ? clear_bhb_loop+0x40/0x90 [ 81.462931][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.462945][ T5840] RIP: 0033:0x7f980b75d68e [ 81.462957][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 81.462969][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 81.462983][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 81.462994][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 81.463003][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 81.463011][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.463020][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 81.463036][ T5840] [ 81.463044][ T5840] BUG: Bad page state in process syz.0.17 pfn:7f5c9 [ 81.767273][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807f5c9528 pfn:0x7f5c9 [ 81.777413][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 81.784579][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 81.793172][ T5840] raw: ffff88807f5c9528 0000000000000001 00000000ffffffff 0000000000000000 [ 81.801808][ T5840] page dumped because: page_pool leak [ 81.807228][ T5840] page_owner tracks the page as allocated [ 81.812936][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790642116, free_ts 80643920044 [ 81.829645][ T5840] post_alloc_hook+0x22d/0x280 [ 81.834458][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 81.840013][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 81.845851][ T5840] __alloc_pages_noprof+0x10/0x100 [ 81.850991][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 81.856529][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 81.862620][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 81.867521][ T5840] do_xdp_generic+0x770/0x12d0 [ 81.872295][ T5840] tun_get_user+0x24a0/0x4350 [ 81.877019][ T5840] tun_chr_write_iter+0x113/0x200 [ 81.882064][ T5840] vfs_write+0x612/0xba0 [ 81.886362][ T5840] ksys_write+0x150/0x270 [ 81.890713][ T5840] do_syscall_64+0x174/0x580 [ 81.895374][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.901287][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 81.907675][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 81.912811][ T5840] rcu_core+0x78b/0x10a0 [ 81.917097][ T5840] handle_softirqs+0x225/0x840 [ 81.921885][ T5840] __irq_exit_rcu+0xca/0x220 [ 81.926532][ T5840] irq_exit_rcu+0x9/0x30 [ 81.930796][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 81.936492][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 81.942494][ T5840] Modules linked in: [ 81.946442][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 81.946469][ T5840] Tainted: [B]=BAD_PAGE [ 81.946476][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 81.946487][ T5840] Call Trace: [ 81.946494][ T5840] [ 81.946502][ T5840] dump_stack_lvl+0xe8/0x150 [ 81.946526][ T5840] bad_page+0x17f/0x1c0 [ 81.946547][ T5840] __free_frozen_pages+0xcca/0xd20 [ 81.946577][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 81.946609][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 81.946640][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 81.946658][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 81.946690][ T5840] do_xdp_generic+0xac2/0x12d0 [ 81.946711][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 81.946732][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 81.946764][ T5840] ? tun_get_user+0x2373/0x4350 [ 81.946789][ T5840] tun_get_user+0x24a0/0x4350 [ 81.946813][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 81.946845][ T5840] ? lock_release+0x4b/0x3c0 [ 81.946876][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 81.946898][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 81.946927][ T5840] ? futex_hash+0x4e/0x2b0 [ 81.946954][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.946975][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 81.946998][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 81.947021][ T5840] ? tun_get+0x1c/0x2f0 [ 81.947043][ T5840] ? tun_get+0x1c/0x2f0 [ 81.947065][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.947083][ T5840] ? tun_get+0x1c/0x2f0 [ 81.947105][ T5840] ? lock_release+0x4b/0x3c0 [ 81.947132][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 81.947158][ T5840] ? tun_get+0x1c/0x2f0 [ 81.947182][ T5840] tun_chr_write_iter+0x113/0x200 [ 81.947208][ T5840] vfs_write+0x612/0xba0 [ 81.947238][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 81.947264][ T5840] ? __pfx_do_futex+0x10/0x10 [ 81.947291][ T5840] ksys_write+0x150/0x270 [ 81.947325][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 81.947353][ T5840] ? rcu_is_watching+0x15/0xb0 [ 81.947373][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.947393][ T5840] do_syscall_64+0x174/0x580 [ 81.947419][ T5840] ? trace_irq_disable+0x3b/0x140 [ 81.947445][ T5840] ? clear_bhb_loop+0x40/0x90 [ 81.947466][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.947486][ T5840] RIP: 0033:0x7f980b75d68e [ 81.947503][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 81.947518][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 81.947538][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 81.947552][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 81.947564][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 81.947576][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.947587][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 81.947609][ T5840] [ 81.947619][ T5840] BUG: Bad page state in process syz.0.17 pfn:34640 [ 82.251947][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034640c80 pfn:0x34640 [ 82.262054][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 82.269210][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 82.277840][ T5840] raw: ffff888034640c80 0000000000000001 00000000ffffffff 0000000000000000 [ 82.286462][ T5840] page dumped because: page_pool leak [ 82.291846][ T5840] page_owner tracks the page as allocated [ 82.297622][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790630226, free_ts 80643931095 [ 82.314327][ T5840] post_alloc_hook+0x22d/0x280 [ 82.319101][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 82.324692][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 82.330533][ T5840] __alloc_pages_noprof+0x10/0x100 [ 82.335695][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 82.341178][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 82.347297][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 82.352184][ T5840] do_xdp_generic+0x770/0x12d0 [ 82.356996][ T5840] tun_get_user+0x24a0/0x4350 [ 82.361693][ T5840] tun_chr_write_iter+0x113/0x200 [ 82.366762][ T5840] vfs_write+0x612/0xba0 [ 82.371027][ T5840] ksys_write+0x150/0x270 [ 82.375403][ T5840] do_syscall_64+0x174/0x580 [ 82.380034][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.385975][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 82.392310][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 82.397470][ T5840] rcu_core+0x78b/0x10a0 [ 82.401721][ T5840] handle_softirqs+0x225/0x840 [ 82.406524][ T5840] __irq_exit_rcu+0xca/0x220 [ 82.411160][ T5840] irq_exit_rcu+0x9/0x30 [ 82.415443][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 82.421115][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 82.427144][ T5840] Modules linked in: [ 82.431064][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 82.431082][ T5840] Tainted: [B]=BAD_PAGE [ 82.431087][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.431095][ T5840] Call Trace: [ 82.431100][ T5840] [ 82.431105][ T5840] dump_stack_lvl+0xe8/0x150 [ 82.431120][ T5840] bad_page+0x17f/0x1c0 [ 82.431135][ T5840] __free_frozen_pages+0xcca/0xd20 [ 82.431154][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 82.431175][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 82.431196][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 82.431208][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 82.431229][ T5840] do_xdp_generic+0xac2/0x12d0 [ 82.431242][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 82.431256][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 82.431278][ T5840] ? tun_get_user+0x2373/0x4350 [ 82.431294][ T5840] tun_get_user+0x24a0/0x4350 [ 82.431309][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 82.431334][ T5840] ? lock_release+0x4b/0x3c0 [ 82.431356][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 82.431369][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 82.431388][ T5840] ? futex_hash+0x4e/0x2b0 [ 82.431406][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.431420][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 82.431435][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 82.431450][ T5840] ? tun_get+0x1c/0x2f0 [ 82.431464][ T5840] ? tun_get+0x1c/0x2f0 [ 82.431478][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.431489][ T5840] ? tun_get+0x1c/0x2f0 [ 82.431503][ T5840] ? lock_release+0x4b/0x3c0 [ 82.431521][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 82.431538][ T5840] ? tun_get+0x1c/0x2f0 [ 82.431554][ T5840] tun_chr_write_iter+0x113/0x200 [ 82.431570][ T5840] vfs_write+0x612/0xba0 [ 82.431589][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 82.431606][ T5840] ? __pfx_do_futex+0x10/0x10 [ 82.431624][ T5840] ksys_write+0x150/0x270 [ 82.431641][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 82.431659][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.431671][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.431684][ T5840] do_syscall_64+0x174/0x580 [ 82.431701][ T5840] ? trace_irq_disable+0x3b/0x140 [ 82.431719][ T5840] ? clear_bhb_loop+0x40/0x90 [ 82.431733][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.431745][ T5840] RIP: 0033:0x7f980b75d68e [ 82.431757][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 82.431767][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 82.431780][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 82.431790][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 82.431798][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 82.431806][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.431813][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 82.431828][ T5840] [ 82.431835][ T5840] BUG: Bad page state in process syz.0.17 pfn:341ac [ 82.735779][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880341acc80 pfn:0x341ac [ 82.745887][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 82.753018][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 82.761642][ T5840] raw: ffff8880341acc80 0000000000000001 00000000ffffffff 0000000000000000 [ 82.770243][ T5840] page dumped because: page_pool leak [ 82.775644][ T5840] page_owner tracks the page as allocated [ 82.781360][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790618744, free_ts 80643942751 [ 82.798071][ T5840] post_alloc_hook+0x22d/0x280 [ 82.802863][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 82.808501][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 82.814355][ T5840] __alloc_pages_noprof+0x10/0x100 [ 82.819471][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 82.824977][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 82.831073][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 82.835958][ T5840] do_xdp_generic+0x770/0x12d0 [ 82.840732][ T5840] tun_get_user+0x24a0/0x4350 [ 82.845442][ T5840] tun_chr_write_iter+0x113/0x200 [ 82.850482][ T5840] vfs_write+0x612/0xba0 [ 82.854784][ T5840] ksys_write+0x150/0x270 [ 82.859136][ T5840] do_syscall_64+0x174/0x580 [ 82.863756][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.869664][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 82.876052][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 82.881190][ T5840] rcu_core+0x78b/0x10a0 [ 82.885470][ T5840] handle_softirqs+0x225/0x840 [ 82.890252][ T5840] __irq_exit_rcu+0xca/0x220 [ 82.894894][ T5840] irq_exit_rcu+0x9/0x30 [ 82.899158][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 82.904842][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 82.910842][ T5840] Modules linked in: [ 82.914785][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 82.914812][ T5840] Tainted: [B]=BAD_PAGE [ 82.914820][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.914831][ T5840] Call Trace: [ 82.914838][ T5840] [ 82.914845][ T5840] dump_stack_lvl+0xe8/0x150 [ 82.914869][ T5840] bad_page+0x17f/0x1c0 [ 82.914891][ T5840] __free_frozen_pages+0xcca/0xd20 [ 82.914921][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 82.914954][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 82.914986][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 82.915005][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 82.915036][ T5840] do_xdp_generic+0xac2/0x12d0 [ 82.915057][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 82.915080][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 82.915125][ T5840] ? tun_get_user+0x2373/0x4350 [ 82.915150][ T5840] tun_get_user+0x24a0/0x4350 [ 82.915174][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 82.915206][ T5840] ? lock_release+0x4b/0x3c0 [ 82.915239][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 82.915259][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 82.915296][ T5840] ? futex_hash+0x4e/0x2b0 [ 82.915324][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.915346][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 82.915369][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 82.915392][ T5840] ? tun_get+0x1c/0x2f0 [ 82.915414][ T5840] ? tun_get+0x1c/0x2f0 [ 82.915436][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.915454][ T5840] ? tun_get+0x1c/0x2f0 [ 82.915476][ T5840] ? lock_release+0x4b/0x3c0 [ 82.915504][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 82.915530][ T5840] ? tun_get+0x1c/0x2f0 [ 82.915554][ T5840] tun_chr_write_iter+0x113/0x200 [ 82.915580][ T5840] vfs_write+0x612/0xba0 [ 82.915609][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 82.915636][ T5840] ? __pfx_do_futex+0x10/0x10 [ 82.915662][ T5840] ksys_write+0x150/0x270 [ 82.915689][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 82.915716][ T5840] ? rcu_is_watching+0x15/0xb0 [ 82.915736][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.915756][ T5840] do_syscall_64+0x174/0x580 [ 82.915782][ T5840] ? trace_irq_disable+0x3b/0x140 [ 82.915808][ T5840] ? clear_bhb_loop+0x40/0x90 [ 82.915829][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.915848][ T5840] RIP: 0033:0x7f980b75d68e [ 82.915865][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 82.915880][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 82.915899][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 82.915914][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 82.915927][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 82.915939][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.915950][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 82.915972][ T5840] [ 82.915983][ T5840] BUG: Bad page state in process syz.0.17 pfn:34641 [ 83.219642][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880346418c0 pfn:0x34641 [ 83.229747][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 83.236897][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 83.245523][ T5840] raw: ffff8880346418c0 0000000000000001 00000000ffffffff 0000000000000000 [ 83.254134][ T5840] page dumped because: page_pool leak [ 83.259496][ T5840] page_owner tracks the page as allocated [ 83.265249][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790606934, free_ts 80643953441 [ 83.281946][ T5840] post_alloc_hook+0x22d/0x280 [ 83.286755][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 83.292329][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 83.298177][ T5840] __alloc_pages_noprof+0x10/0x100 [ 83.303308][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 83.308822][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 83.314931][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 83.319784][ T5840] do_xdp_generic+0x770/0x12d0 [ 83.324602][ T5840] tun_get_user+0x24a0/0x4350 [ 83.329305][ T5840] tun_chr_write_iter+0x113/0x200 [ 83.334374][ T5840] vfs_write+0x612/0xba0 [ 83.338639][ T5840] ksys_write+0x150/0x270 [ 83.342966][ T5840] do_syscall_64+0x174/0x580 [ 83.347590][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.353527][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 83.359848][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 83.365006][ T5840] rcu_core+0x78b/0x10a0 [ 83.369266][ T5840] handle_softirqs+0x225/0x840 [ 83.374072][ T5840] __irq_exit_rcu+0xca/0x220 [ 83.378688][ T5840] irq_exit_rcu+0x9/0x30 [ 83.382933][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 83.388598][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 83.394609][ T5840] Modules linked in: [ 83.398505][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 83.398524][ T5840] Tainted: [B]=BAD_PAGE [ 83.398529][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 83.398537][ T5840] Call Trace: [ 83.398542][ T5840] [ 83.398548][ T5840] dump_stack_lvl+0xe8/0x150 [ 83.398564][ T5840] bad_page+0x17f/0x1c0 [ 83.398579][ T5840] __free_frozen_pages+0xcca/0xd20 [ 83.398600][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 83.398633][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 83.398654][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 83.398665][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 83.398686][ T5840] do_xdp_generic+0xac2/0x12d0 [ 83.398700][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 83.398714][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 83.398736][ T5840] ? tun_get_user+0x2373/0x4350 [ 83.398752][ T5840] tun_get_user+0x24a0/0x4350 [ 83.398768][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 83.398789][ T5840] ? lock_release+0x4b/0x3c0 [ 83.398811][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 83.398825][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 83.398844][ T5840] ? futex_hash+0x4e/0x2b0 [ 83.398862][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.398876][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 83.398891][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 83.398906][ T5840] ? tun_get+0x1c/0x2f0 [ 83.398920][ T5840] ? tun_get+0x1c/0x2f0 [ 83.398934][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.398946][ T5840] ? tun_get+0x1c/0x2f0 [ 83.398960][ T5840] ? lock_release+0x4b/0x3c0 [ 83.398978][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 83.398995][ T5840] ? tun_get+0x1c/0x2f0 [ 83.399011][ T5840] tun_chr_write_iter+0x113/0x200 [ 83.399027][ T5840] vfs_write+0x612/0xba0 [ 83.399047][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 83.399063][ T5840] ? __pfx_do_futex+0x10/0x10 [ 83.399081][ T5840] ksys_write+0x150/0x270 [ 83.399098][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 83.399115][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.399128][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.399141][ T5840] do_syscall_64+0x174/0x580 [ 83.399157][ T5840] ? trace_irq_disable+0x3b/0x140 [ 83.399174][ T5840] ? clear_bhb_loop+0x40/0x90 [ 83.399188][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.399200][ T5840] RIP: 0033:0x7f980b75d68e [ 83.399211][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 83.399222][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 83.399239][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 83.399248][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 83.399257][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 83.399264][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.399272][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 83.399287][ T5840] [ 83.399295][ T5840] BUG: Bad page state in process syz.0.17 pfn:79889 [ 83.702910][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880798898c0 pfn:0x79889 [ 83.713105][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 83.720249][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 83.728869][ T5840] raw: ffff8880798898c0 0000000000000001 00000000ffffffff 0000000000000000 [ 83.737487][ T5840] page dumped because: page_pool leak [ 83.742842][ T5840] page_owner tracks the page as allocated [ 83.748587][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790594976, free_ts 80643971015 [ 83.765296][ T5840] post_alloc_hook+0x22d/0x280 [ 83.770070][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 83.775681][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 83.781515][ T5840] __alloc_pages_noprof+0x10/0x100 [ 83.786684][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 83.792193][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 83.798326][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 83.803221][ T5840] do_xdp_generic+0x770/0x12d0 [ 83.808039][ T5840] tun_get_user+0x24a0/0x4350 [ 83.812745][ T5840] tun_chr_write_iter+0x113/0x200 [ 83.817836][ T5840] vfs_write+0x612/0xba0 [ 83.822128][ T5840] ksys_write+0x150/0x270 [ 83.826533][ T5840] do_syscall_64+0x174/0x580 [ 83.831158][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.837125][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 83.843487][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 83.848629][ T5840] rcu_core+0x78b/0x10a0 [ 83.852906][ T5840] handle_softirqs+0x225/0x840 [ 83.857707][ T5840] __irq_exit_rcu+0xca/0x220 [ 83.862297][ T5840] irq_exit_rcu+0x9/0x30 [ 83.866589][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 83.872339][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 83.878361][ T5840] Modules linked in: [ 83.882273][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 83.882292][ T5840] Tainted: [B]=BAD_PAGE [ 83.882296][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 83.882304][ T5840] Call Trace: [ 83.882309][ T5840] [ 83.882314][ T5840] dump_stack_lvl+0xe8/0x150 [ 83.882330][ T5840] bad_page+0x17f/0x1c0 [ 83.882344][ T5840] __free_frozen_pages+0xcca/0xd20 [ 83.882363][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 83.882384][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 83.882404][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 83.882416][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 83.882437][ T5840] do_xdp_generic+0xac2/0x12d0 [ 83.882450][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 83.882464][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 83.882486][ T5840] ? tun_get_user+0x2373/0x4350 [ 83.882501][ T5840] tun_get_user+0x24a0/0x4350 [ 83.882517][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 83.882538][ T5840] ? lock_release+0x4b/0x3c0 [ 83.882559][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 83.882572][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 83.882591][ T5840] ? futex_hash+0x4e/0x2b0 [ 83.882610][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.882623][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 83.882672][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 83.882696][ T5840] ? tun_get+0x1c/0x2f0 [ 83.882718][ T5840] ? tun_get+0x1c/0x2f0 [ 83.882742][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.882754][ T5840] ? tun_get+0x1c/0x2f0 [ 83.882770][ T5840] ? lock_release+0x4b/0x3c0 [ 83.882789][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 83.882808][ T5840] ? tun_get+0x1c/0x2f0 [ 83.882825][ T5840] tun_chr_write_iter+0x113/0x200 [ 83.882843][ T5840] vfs_write+0x612/0xba0 [ 83.882864][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 83.882883][ T5840] ? __pfx_do_futex+0x10/0x10 [ 83.882902][ T5840] ksys_write+0x150/0x270 [ 83.882921][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 83.882940][ T5840] ? rcu_is_watching+0x15/0xb0 [ 83.882954][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.882967][ T5840] do_syscall_64+0x174/0x580 [ 83.882985][ T5840] ? trace_irq_disable+0x3b/0x140 [ 83.883003][ T5840] ? clear_bhb_loop+0x40/0x90 [ 83.883018][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.883031][ T5840] RIP: 0033:0x7f980b75d68e [ 83.883043][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 83.883054][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 83.883068][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 83.883078][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 83.883087][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 83.883095][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.883103][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 83.883119][ T5840] [ 83.883126][ T5840] BUG: Bad page state in process syz.0.17 pfn:7988a [ 84.186828][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807988adc0 pfn:0x7988a [ 84.196945][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 84.204093][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 84.212692][ T5840] raw: ffff88807988adc0 0000000000000001 00000000ffffffff 0000000000000000 [ 84.221322][ T5840] page dumped because: page_pool leak [ 84.226725][ T5840] page_owner tracks the page as allocated [ 84.232445][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790583005, free_ts 80643981491 [ 84.249197][ T5840] post_alloc_hook+0x22d/0x280 [ 84.254029][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 84.259589][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 84.265454][ T5840] __alloc_pages_noprof+0x10/0x100 [ 84.270593][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 84.276104][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 84.282199][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 84.287099][ T5840] do_xdp_generic+0x770/0x12d0 [ 84.291887][ T5840] tun_get_user+0x24a0/0x4350 [ 84.296613][ T5840] tun_chr_write_iter+0x113/0x200 [ 84.301664][ T5840] vfs_write+0x612/0xba0 [ 84.305963][ T5840] ksys_write+0x150/0x270 [ 84.310321][ T5840] do_syscall_64+0x174/0x580 [ 84.314956][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.320867][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 84.327254][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 84.332387][ T5840] rcu_core+0x78b/0x10a0 [ 84.336672][ T5840] handle_softirqs+0x225/0x840 [ 84.341497][ T5840] __irq_exit_rcu+0xca/0x220 [ 84.346171][ T5840] irq_exit_rcu+0x9/0x30 [ 84.350442][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 84.356130][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 84.362149][ T5840] Modules linked in: [ 84.366114][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 84.366159][ T5840] Tainted: [B]=BAD_PAGE [ 84.366166][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 84.366176][ T5840] Call Trace: [ 84.366183][ T5840] [ 84.366190][ T5840] dump_stack_lvl+0xe8/0x150 [ 84.366212][ T5840] bad_page+0x17f/0x1c0 [ 84.366233][ T5840] __free_frozen_pages+0xcca/0xd20 [ 84.366260][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 84.366290][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 84.366319][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 84.366335][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 84.366365][ T5840] do_xdp_generic+0xac2/0x12d0 [ 84.366384][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 84.366405][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 84.366436][ T5840] ? tun_get_user+0x2373/0x4350 [ 84.366458][ T5840] tun_get_user+0x24a0/0x4350 [ 84.366480][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 84.366510][ T5840] ? lock_release+0x4b/0x3c0 [ 84.366540][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 84.366559][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 84.366603][ T5840] ? futex_hash+0x4e/0x2b0 [ 84.366629][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.366651][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 84.366674][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 84.366697][ T5840] ? tun_get+0x1c/0x2f0 [ 84.366719][ T5840] ? tun_get+0x1c/0x2f0 [ 84.366742][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.366760][ T5840] ? tun_get+0x1c/0x2f0 [ 84.366781][ T5840] ? lock_release+0x4b/0x3c0 [ 84.366809][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 84.366835][ T5840] ? tun_get+0x1c/0x2f0 [ 84.366859][ T5840] tun_chr_write_iter+0x113/0x200 [ 84.366884][ T5840] vfs_write+0x612/0xba0 [ 84.366913][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 84.366938][ T5840] ? __pfx_do_futex+0x10/0x10 [ 84.366964][ T5840] ksys_write+0x150/0x270 [ 84.366991][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 84.367018][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.367038][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.367058][ T5840] do_syscall_64+0x174/0x580 [ 84.367084][ T5840] ? trace_irq_disable+0x3b/0x140 [ 84.367109][ T5840] ? clear_bhb_loop+0x40/0x90 [ 84.367163][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.367182][ T5840] RIP: 0033:0x7f980b75d68e [ 84.367199][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.367215][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.367235][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 84.367249][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 84.367261][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 84.367273][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.367284][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 84.367306][ T5840] [ 84.367316][ T5840] BUG: Bad page state in process syz.0.17 pfn:7988b [ 84.671028][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807988b640 pfn:0x7988b [ 84.681162][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 84.688312][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 84.696937][ T5840] raw: ffff88807988b640 0000000000000001 00000000ffffffff 0000000000000000 [ 84.705543][ T5840] page dumped because: page_pool leak [ 84.710899][ T5840] page_owner tracks the page as allocated [ 84.716643][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790571274, free_ts 80643991152 [ 84.733356][ T5840] post_alloc_hook+0x22d/0x280 [ 84.738194][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 84.743783][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 84.749602][ T5840] __alloc_pages_noprof+0x10/0x100 [ 84.754769][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 84.760254][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 84.766372][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 84.771246][ T5840] do_xdp_generic+0x770/0x12d0 [ 84.776148][ T5840] tun_get_user+0x24a0/0x4350 [ 84.780853][ T5840] tun_chr_write_iter+0x113/0x200 [ 84.785948][ T5840] vfs_write+0x612/0xba0 [ 84.790207][ T5840] ksys_write+0x150/0x270 [ 84.794576][ T5840] do_syscall_64+0x174/0x580 [ 84.799188][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.805140][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 84.811478][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 84.816627][ T5840] rcu_core+0x78b/0x10a0 [ 84.820877][ T5840] handle_softirqs+0x225/0x840 [ 84.825685][ T5840] __irq_exit_rcu+0xca/0x220 [ 84.830299][ T5840] irq_exit_rcu+0x9/0x30 [ 84.834582][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 84.840235][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 84.846254][ T5840] Modules linked in: [ 84.850168][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 84.850186][ T5840] Tainted: [B]=BAD_PAGE [ 84.850191][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 84.850199][ T5840] Call Trace: [ 84.850204][ T5840] [ 84.850209][ T5840] dump_stack_lvl+0xe8/0x150 [ 84.850225][ T5840] bad_page+0x17f/0x1c0 [ 84.850239][ T5840] __free_frozen_pages+0xcca/0xd20 [ 84.850259][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 84.850280][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 84.850301][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 84.850312][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 84.850333][ T5840] do_xdp_generic+0xac2/0x12d0 [ 84.850346][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 84.850361][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 84.850382][ T5840] ? tun_get_user+0x2373/0x4350 [ 84.850397][ T5840] tun_get_user+0x24a0/0x4350 [ 84.850413][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 84.850435][ T5840] ? lock_release+0x4b/0x3c0 [ 84.850456][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 84.850470][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 84.850488][ T5840] ? futex_hash+0x4e/0x2b0 [ 84.850507][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.850521][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 84.850536][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 84.850550][ T5840] ? tun_get+0x1c/0x2f0 [ 84.850565][ T5840] ? tun_get+0x1c/0x2f0 [ 84.850579][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.850590][ T5840] ? tun_get+0x1c/0x2f0 [ 84.850604][ T5840] ? lock_release+0x4b/0x3c0 [ 84.850622][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 84.850639][ T5840] ? tun_get+0x1c/0x2f0 [ 84.850655][ T5840] tun_chr_write_iter+0x113/0x200 [ 84.850671][ T5840] vfs_write+0x612/0xba0 [ 84.850691][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 84.850708][ T5840] ? __pfx_do_futex+0x10/0x10 [ 84.850725][ T5840] ksys_write+0x150/0x270 [ 84.850742][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 84.850760][ T5840] ? rcu_is_watching+0x15/0xb0 [ 84.850773][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.850785][ T5840] do_syscall_64+0x174/0x580 [ 84.850801][ T5840] ? trace_irq_disable+0x3b/0x140 [ 84.850819][ T5840] ? clear_bhb_loop+0x40/0x90 [ 84.850833][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.850845][ T5840] RIP: 0033:0x7f980b75d68e [ 84.850856][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.850867][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.850880][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 84.850890][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 84.850898][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 84.850906][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.850913][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 84.850928][ T5840] [ 84.850935][ T5840] BUG: Bad page state in process syz.0.17 pfn:213a2 [ 85.154551][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880213a2640 pfn:0x213a2 [ 85.164662][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 85.171787][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 85.180414][ T5840] raw: ffff8880213a2640 0000000000000001 00000000ffffffff 0000000000000000 [ 85.189081][ T5840] page dumped because: page_pool leak [ 85.194536][ T5840] page_owner tracks the page as allocated [ 85.200262][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790559374, free_ts 80644001406 [ 85.216970][ T5840] post_alloc_hook+0x22d/0x280 [ 85.221753][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 85.227379][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 85.233217][ T5840] __alloc_pages_noprof+0x10/0x100 [ 85.238383][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 85.243885][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 85.249958][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 85.254879][ T5840] do_xdp_generic+0x770/0x12d0 [ 85.259660][ T5840] tun_get_user+0x24a0/0x4350 [ 85.264382][ T5840] tun_chr_write_iter+0x113/0x200 [ 85.269445][ T5840] vfs_write+0x612/0xba0 [ 85.273768][ T5840] ksys_write+0x150/0x270 [ 85.278117][ T5840] do_syscall_64+0x174/0x580 [ 85.282709][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.288651][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 85.295007][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 85.300139][ T5840] rcu_core+0x78b/0x10a0 [ 85.304423][ T5840] handle_softirqs+0x225/0x840 [ 85.309206][ T5840] __irq_exit_rcu+0xca/0x220 [ 85.313862][ T5840] irq_exit_rcu+0x9/0x30 [ 85.318149][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 85.323825][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.329822][ T5840] Modules linked in: [ 85.333774][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 85.333800][ T5840] Tainted: [B]=BAD_PAGE [ 85.333807][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 85.333817][ T5840] Call Trace: [ 85.333824][ T5840] [ 85.333831][ T5840] dump_stack_lvl+0xe8/0x150 [ 85.333855][ T5840] bad_page+0x17f/0x1c0 [ 85.333877][ T5840] __free_frozen_pages+0xcca/0xd20 [ 85.333925][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 85.333957][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 85.333989][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 85.334008][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 85.334041][ T5840] do_xdp_generic+0xac2/0x12d0 [ 85.334062][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 85.334085][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 85.334128][ T5840] ? tun_get_user+0x2373/0x4350 [ 85.334154][ T5840] tun_get_user+0x24a0/0x4350 [ 85.334178][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 85.334211][ T5840] ? lock_release+0x4b/0x3c0 [ 85.334244][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 85.334265][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 85.334294][ T5840] ? futex_hash+0x4e/0x2b0 [ 85.334322][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.334345][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 85.334369][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 85.334392][ T5840] ? tun_get+0x1c/0x2f0 [ 85.334415][ T5840] ? tun_get+0x1c/0x2f0 [ 85.334438][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.334457][ T5840] ? tun_get+0x1c/0x2f0 [ 85.334480][ T5840] ? lock_release+0x4b/0x3c0 [ 85.334508][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 85.334535][ T5840] ? tun_get+0x1c/0x2f0 [ 85.334561][ T5840] tun_chr_write_iter+0x113/0x200 [ 85.334586][ T5840] vfs_write+0x612/0xba0 [ 85.334617][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 85.334644][ T5840] ? __pfx_do_futex+0x10/0x10 [ 85.334672][ T5840] ksys_write+0x150/0x270 [ 85.334700][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 85.334728][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.334749][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.334770][ T5840] do_syscall_64+0x174/0x580 [ 85.334795][ T5840] ? trace_irq_disable+0x3b/0x140 [ 85.334822][ T5840] ? clear_bhb_loop+0x40/0x90 [ 85.334845][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.334864][ T5840] RIP: 0033:0x7f980b75d68e [ 85.334882][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 85.334898][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.334919][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 85.334934][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 85.334947][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 85.334959][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.334970][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 85.334993][ T5840] [ 85.335004][ T5840] BUG: Bad page state in process syz.0.17 pfn:77f8c [ 85.639104][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888077f8c500 pfn:0x77f8c [ 85.649221][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 85.656456][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 85.665107][ T5840] raw: ffff888077f8c500 0000000000000001 00000000ffffffff 0000000000000000 [ 85.673732][ T5840] page dumped because: page_pool leak [ 85.679098][ T5840] page_owner tracks the page as allocated [ 85.684849][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790546919, free_ts 80644012462 [ 85.701570][ T5840] post_alloc_hook+0x22d/0x280 [ 85.706383][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 85.711946][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 85.717809][ T5840] __alloc_pages_noprof+0x10/0x100 [ 85.722936][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 85.728444][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 85.734563][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 85.739430][ T5840] do_xdp_generic+0x770/0x12d0 [ 85.744256][ T5840] tun_get_user+0x24a0/0x4350 [ 85.748958][ T5840] tun_chr_write_iter+0x113/0x200 [ 85.754046][ T5840] vfs_write+0x612/0xba0 [ 85.758316][ T5840] ksys_write+0x150/0x270 [ 85.762646][ T5840] do_syscall_64+0x174/0x580 [ 85.767297][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.773218][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 85.779592][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 85.784746][ T5840] rcu_core+0x78b/0x10a0 [ 85.788981][ T5840] handle_softirqs+0x225/0x840 [ 85.793784][ T5840] __irq_exit_rcu+0xca/0x220 [ 85.798390][ T5840] irq_exit_rcu+0x9/0x30 [ 85.802649][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 85.808348][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.814364][ T5840] Modules linked in: [ 85.818269][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 85.818286][ T5840] Tainted: [B]=BAD_PAGE [ 85.818291][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 85.818299][ T5840] Call Trace: [ 85.818304][ T5840] [ 85.818309][ T5840] dump_stack_lvl+0xe8/0x150 [ 85.818325][ T5840] bad_page+0x17f/0x1c0 [ 85.818339][ T5840] __free_frozen_pages+0xcca/0xd20 [ 85.818359][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 85.818380][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 85.818401][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 85.818412][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 85.818434][ T5840] do_xdp_generic+0xac2/0x12d0 [ 85.818447][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 85.818462][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 85.818483][ T5840] ? tun_get_user+0x2373/0x4350 [ 85.818500][ T5840] tun_get_user+0x24a0/0x4350 [ 85.818515][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 85.818536][ T5840] ? lock_release+0x4b/0x3c0 [ 85.818557][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 85.818571][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 85.818590][ T5840] ? futex_hash+0x4e/0x2b0 [ 85.818608][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.818622][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 85.818637][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 85.818652][ T5840] ? tun_get+0x1c/0x2f0 [ 85.818666][ T5840] ? tun_get+0x1c/0x2f0 [ 85.818680][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.818691][ T5840] ? tun_get+0x1c/0x2f0 [ 85.818705][ T5840] ? lock_release+0x4b/0x3c0 [ 85.818723][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 85.818740][ T5840] ? tun_get+0x1c/0x2f0 [ 85.818756][ T5840] tun_chr_write_iter+0x113/0x200 [ 85.818772][ T5840] vfs_write+0x612/0xba0 [ 85.818792][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 85.818809][ T5840] ? __pfx_do_futex+0x10/0x10 [ 85.818827][ T5840] ksys_write+0x150/0x270 [ 85.818844][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 85.818861][ T5840] ? rcu_is_watching+0x15/0xb0 [ 85.818874][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.818887][ T5840] do_syscall_64+0x174/0x580 [ 85.818903][ T5840] ? trace_irq_disable+0x3b/0x140 [ 85.818921][ T5840] ? clear_bhb_loop+0x40/0x90 [ 85.818935][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.818947][ T5840] RIP: 0033:0x7f980b75d68e [ 85.818958][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 85.818969][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.818982][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 85.818991][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 85.818999][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 85.819007][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.819015][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 85.819029][ T5840] [ 85.819037][ T5840] BUG: Bad page state in process syz.0.17 pfn:123d7 [ 86.123133][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880123d7210 pfn:0x123d7 [ 86.133241][ T5840] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 86.140400][ T5840] raw: 00fff00000000000 dead000000000040 ffff888022aed000 0000000000000000 [ 86.149028][ T5840] raw: ffff8880123d7210 0000000000000001 00000000ffffffff 0000000000000000 [ 86.157637][ T5840] page dumped because: page_pool leak [ 86.162995][ T5840] page_owner tracks the page as allocated [ 86.168746][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5840, tgid 5840 (syz.0.17), ts 80790535005, free_ts 80644023521 [ 86.185545][ T5840] post_alloc_hook+0x22d/0x280 [ 86.190309][ T5840] get_page_from_freelist+0x24ae/0x2530 [ 86.195902][ T5840] __alloc_frozen_pages_noprof+0x18d/0x380 [ 86.201728][ T5840] __alloc_pages_noprof+0x10/0x100 [ 86.206887][ T5840] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 86.212373][ T5840] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 86.218488][ T5840] skb_pp_cow_data+0xcd0/0x19a0 [ 86.223383][ T5840] do_xdp_generic+0x770/0x12d0 [ 86.228206][ T5840] tun_get_user+0x24a0/0x4350 [ 86.232894][ T5840] tun_chr_write_iter+0x113/0x200 [ 86.237967][ T5840] vfs_write+0x612/0xba0 [ 86.242232][ T5840] ksys_write+0x150/0x270 [ 86.246622][ T5840] do_syscall_64+0x174/0x580 [ 86.251234][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.257175][ T5840] page last free pid 5836 tgid 5836 stack trace: [ 86.263540][ T5840] __free_frozen_pages+0xc0d/0xd20 [ 86.268654][ T5840] rcu_core+0x78b/0x10a0 [ 86.272891][ T5840] handle_softirqs+0x225/0x840 [ 86.277719][ T5840] __irq_exit_rcu+0xca/0x220 [ 86.282334][ T5840] irq_exit_rcu+0x9/0x30 [ 86.286626][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 86.292279][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 86.298305][ T5840] Modules linked in: [ 86.302220][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) [ 86.302240][ T5840] Tainted: [B]=BAD_PAGE [ 86.302245][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 86.302254][ T5840] Call Trace: [ 86.302259][ T5840] [ 86.302264][ T5840] dump_stack_lvl+0xe8/0x150 [ 86.302281][ T5840] bad_page+0x17f/0x1c0 [ 86.302297][ T5840] __free_frozen_pages+0xcca/0xd20 [ 86.302318][ T5840] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 86.302342][ T5840] bpf_xdp_adjust_tail+0x1ce/0x210 [ 86.302365][ T5840] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 86.302377][ T5840] bpf_prog_run_generic_xdp+0x5e3/0x14b0 [ 86.302401][ T5840] do_xdp_generic+0xac2/0x12d0 [ 86.302416][ T5840] ? do_xdp_generic+0x6ba/0x12d0 [ 86.302432][ T5840] ? __pfx_do_xdp_generic+0x10/0x10 [ 86.302456][ T5840] ? tun_get_user+0x2373/0x4350 [ 86.302473][ T5840] tun_get_user+0x24a0/0x4350 [ 86.302491][ T5840] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 86.302514][ T5840] ? lock_release+0x4b/0x3c0 [ 86.302538][ T5840] ? aa_file_perm+0x4ed/0x15f0 [ 86.302554][ T5840] ? __pfx_tun_get_user+0x10/0x10 [ 86.302575][ T5840] ? futex_hash+0x4e/0x2b0 [ 86.302595][ T5840] ? rcu_is_watching+0x15/0xb0 [ 86.302611][ T5840] ? ref_tracker_alloc+0x341/0x4b0 [ 86.302630][ T5840] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 86.302646][ T5840] ? tun_get+0x1c/0x2f0 [ 86.302662][ T5840] ? tun_get+0x1c/0x2f0 [ 86.302678][ T5840] ? rcu_is_watching+0x15/0xb0 [ 86.302691][ T5840] ? tun_get+0x1c/0x2f0 [ 86.302707][ T5840] ? lock_release+0x4b/0x3c0 [ 86.302727][ T5840] ? apparmor_file_permission+0x1f4/0x300 [ 86.302747][ T5840] ? tun_get+0x1c/0x2f0 [ 86.302765][ T5840] tun_chr_write_iter+0x113/0x200 [ 86.302783][ T5840] vfs_write+0x612/0xba0 [ 86.302817][ T5840] ? __pfx_vfs_write+0x10/0x10 [ 86.302836][ T5840] ? __pfx_do_futex+0x10/0x10 [ 86.302855][ T5840] ksys_write+0x150/0x270 [ 86.302874][ T5840] ? __pfx_ksys_write+0x10/0x10 [ 86.302893][ T5840] ? rcu_is_watching+0x15/0xb0 [ 86.302907][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.302921][ T5840] do_syscall_64+0x174/0x580 [ 86.302938][ T5840] ? trace_irq_disable+0x3b/0x140 [ 86.302957][ T5840] ? clear_bhb_loop+0x40/0x90 [ 86.302972][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.302985][ T5840] RIP: 0033:0x7f980b75d68e [ 86.302997][ T5840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 86.303008][ T5840] RSP: 002b:00007ffe26ab8ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.303021][ T5840] RAX: ffffffffffffffda RBX: 000055556b38e500 RCX: 00007f980b75d68e [ 86.303031][ T5840] RDX: 000000000000fe54 RSI: 0000200000001b00 RDI: 00000000000000c8 [ 86.303040][ T5840] RBP: 00007f980b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 86.303048][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.303056][ T5840] R13: 00007f980ba15fac R14: 00007f980ba15fa0 R15: 00007f980ba15fa0 [ 86.303072][ T5840] [ 86.643528][ T4938] Bluetooth: hci0: command tx timeout [ 86.734342][ T1225] cfg80211: failed to load regulatory.db