BUG: Bad page state in process syz.1.10480 pfn:3d9ac
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d9acac0 pfn:0x3d9ac
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff88803d9acac0 3ffffffffffffffc 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5943, tgid 5943 (kworker/u8:11), ts 990217032599
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmems net/core/page_pool.c:688 [inline]
page_pool_alloc_frag_netmem+0x561/0x9b0 net/core/page_pool.c:1090
page_pool_alloc_netmem include/net/page_pool/helpers.h:139 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_alloc_va include/net/page_pool/helpers.h:206 [inline]
page_pool_dev_alloc_va include/net/page_pool/helpers.h:229 [inline]
skb_pp_cow_data+0x1eb/0x18e0 net/core/skbuff.c:958
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
__netif_receive_skb_core+0x110b/0x30f0 net/core/dev.c:6235
__netif_receive_skb_one_core net/core/dev.c:6431 [inline]
__netif_receive_skb net/core/dev.c:6546 [inline]
process_backlog+0x727/0x18b0 net/core/dev.c:6897
__napi_poll+0xaa/0x330 net/core/dev.c:7977
napi_poll net/core/dev.c:8040 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:8197
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
do_softirq+0x77/0xd0 kernel/softirq.c:569
__local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
page last free pid 6770 tgid 6770 ts 990197743179 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
tlb_batch_list_free mm/mmu_gather.c:161 [inline]
tlb_finish_mmu+0x13e/0x220 mm/mmu_gather.c:532
exit_mmap+0x4b2/0xa40 mm/mmap.c:1328
__mmput+0x118/0x420 kernel/fork.c:1192
exit_mm+0x18e/0x240 kernel/exit.c:586
do_exit+0x6a8/0x2360 kernel/exit.c:967
do_group_exit+0x22d/0x2f0 kernel/exit.c:1123
__do_sys_exit_group kernel/exit.c:1134 [inline]
__se_sys_exit_group kernel/exit.c:1132 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1132
x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:5e2e4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x5e2e4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309534006
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 17256 tgid 17256 ts 1586502548804 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
do_softirq+0x77/0xd0 kernel/softirq.c:569
__local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
spin_unlock_bh include/linux/spinlock.h:407 [inline]
mirred_device_event+0x1c8/0x2b0 net/sched/act_mirred.c:571
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:86
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
unregister_netdevice_many_notify+0x1432/0x1d80 net/core/dev.c:12736
unregister_netdevice_many net/core/dev.c:12807 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12603
unregister_netdevice include/linux/netdevice.h:3511 [inline]
__tun_detach+0x1074/0x1900 drivers/net/tun.c:641
tun_detach drivers/net/tun.c:657 [inline]
tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3608
__fput+0x408/0xa40 fs/file_table.c:512
fput_close_sync+0x11f/0x240 fs/file_table.c:618
filp_close_sync+0x6e/0xa0 fs/open.c:1573
__range_close fs/file.c:919 [inline]
__do_sys_close_range fs/file.c:1003 [inline]
__se_sys_close_range+0xa77/0xef0 fs/file.c:954
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:7d2a0
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x7d2a0
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309483396
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 15982 tgid 15982 ts 1586707609466 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
___free_pages_bulk mm/kasan/shadow.c:333 [inline]
__kasan_populate_vmalloc_do mm/kasan/shadow.c:385 [inline]
__kasan_populate_vmalloc+0x12d/0x1c0 mm/kasan/shadow.c:424
kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
alloc_vmap_area+0xd10/0x1410 mm/vmalloc.c:2151
__get_vm_area_node+0x200/0x2f0 mm/vmalloc.c:3281
__vmalloc_node_range_noprof+0x36e/0x16f0 mm/vmalloc.c:4112
__vmalloc_node_noprof mm/vmalloc.c:4213 [inline]
vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4291
alloc_counters+0x63/0x5d0 net/ipv6/netfilter/ip6_tables.c:820
copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:842 [inline]
get_entries net/ipv6/netfilter/ip6_tables.c:1042 [inline]
do_ip6t_get_ctl+0xb17/0x12f0 net/ipv6/netfilter/ip6_tables.c:1683
nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x213/0x2c0 net/ipv6/ipv6_sockglue.c:1371
do_sock_getsockopt+0x4aa/0x640 net/socket.c:2505
__sys_getsockopt net/socket.c:2536 [inline]
__do_sys_getsockopt net/socket.c:2543 [inline]
__se_sys_getsockopt net/socket.c:2540 [inline]
__x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2540
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:40662
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040662dc0 pfn:0x40662
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888040662dc0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309464532
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 15 tgid 15 ts 1586711339250 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1133
smpboot_thread_fn+0x5f8/0xb30 kernel/smpboot.c:162
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:13569
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880135693c0 pfn:0x13569
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff8880135693c0 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309446045
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 15 tgid 15 ts 1586711355113 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1133
smpboot_thread_fn+0x5f8/0xb30 kernel/smpboot.c:162
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:80bca
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888080bca000 pfn:0x80bca
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888080bca000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309427819
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 15 tgid 15 ts 1586711613211 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1133
smpboot_thread_fn+0x5f8/0xb30 kernel/smpboot.c:162
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:904f4
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x904f4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309409196
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 15 tgid 15 ts 1586711649669 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1133
smpboot_thread_fn+0x5f8/0xb30 kernel/smpboot.c:162
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:9b211
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88809b211000 pfn:0x9b211
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff88809b211000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309390338
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11829 tgid 11829 ts 1586870202981 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
___free_pages_bulk mm/kasan/shadow.c:333 [inline]
__kasan_populate_vmalloc_do mm/kasan/shadow.c:385 [inline]
__kasan_populate_vmalloc+0x12d/0x1c0 mm/kasan/shadow.c:424
kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
alloc_vmap_area+0xd10/0x1410 mm/vmalloc.c:2151
__get_vm_area_node+0x200/0x2f0 mm/vmalloc.c:3281
__vmalloc_node_range_noprof+0x36e/0x16f0 mm/vmalloc.c:4112
__vmalloc_node_noprof mm/vmalloc.c:4213 [inline]
vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4291
alloc_counters net/ipv4/netfilter/arp_tables.c:671 [inline]
copy_entries_to_user net/ipv4/netfilter/arp_tables.c:692 [inline]
get_entries net/ipv4/netfilter/arp_tables.c:787 [inline]
do_arpt_get_ctl+0x915/0x1270 net/ipv4/netfilter/arp_tables.c:1013
nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x19e/0x230 net/ipv4/ip_sockglue.c:1785
do_sock_getsockopt+0x4aa/0x640 net/socket.c:2505
__sys_getsockopt net/socket.c:2536 [inline]
__do_sys_getsockopt net/socket.c:2543 [inline]
__se_sys_getsockopt net/socket.c:2540 [inline]
__x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2540
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:7d19e
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807d19e000 pfn:0x7d19e
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff88807d19e000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309372123
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11829 tgid 11829 ts 1586870318682 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
free_pages_prepare+0x9eb/0xaf0 mm/page_alloc.c:1448
__free_contig_range_common+0x174/0x340 mm/page_alloc.c:7062
__free_contig_range mm/page_alloc.c:7107 [inline]
free_pages_bulk+0x48/0x120 mm/page_alloc.c:5330
vm_area_free_pages mm/vmalloc.c:3498 [inline]
vfree+0x22c/0x490 mm/vmalloc.c:3547
copy_entries_to_user net/ipv4/netfilter/arp_tables.c:722 [inline]
get_entries net/ipv4/netfilter/arp_tables.c:787 [inline]
do_arpt_get_ctl+0x104e/0x1270 net/ipv4/netfilter/arp_tables.c:1013
nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x19e/0x230 net/ipv4/ip_sockglue.c:1785
do_sock_getsockopt+0x4aa/0x640 net/socket.c:2505
__sys_getsockopt net/socket.c:2536 [inline]
__do_sys_getsockopt net/socket.c:2543 [inline]
__se_sys_getsockopt net/socket.c:2540 [inline]
__x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2540
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:98324
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x98324
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309354197
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 30 tgid 30 ts 1586880317511 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:3b2d9
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x3b2d9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309335983
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 30 tgid 30 ts 1586880353105 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48
BUG: Bad page state in process syz.1.10480 pfn:429a0
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880429a0c80 pfn:0x429a0
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000040 ffff8880246dc000 0000000000000000
raw: ffff8880429a0c80 0000000000000001 00000000ffffffff 0000000000000000
page dumped because: page_pool leak
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 17323, tgid 17319 (syz.1.10480), ts 1587309317469
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5444
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5479
alloc_pages_bulk_noprof+0x67a/0x8a0 mm/page_alloc.c:5303
alloc_pages_bulk_node_noprof include/linux/gfp.h:231 [inline]
__page_pool_alloc_netmems_slow+0x14f/0x720 net/core/page_pool.c:637
page_pool_alloc_netmem include/net/page_pool/helpers.h:136 [inline]
page_pool_alloc include/net/page_pool/helpers.h:175 [inline]
page_pool_dev_alloc include/net/page_pool/helpers.h:196 [inline]
skb_pp_cow_data+0xc08/0x18e0 net/core/skbuff.c:991
netif_skb_check_for_xdp net/core/dev.c:5780 [inline]
netif_receive_generic_xdp net/core/dev.c:5821 [inline]
do_xdp_generic+0x761/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 30 tgid 30 ts 1586880386168 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
__tlb_remove_table_free mm/mmu_gather.c:226 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x92e/0x1230 kernel/rcu/tree.c:2919
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
Modules linked in:
CPU: 0 UID: 0 PID: 17323 Comm: syz.1.10480 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
bad_page+0xdc/0x120 mm/page_alloc.c:630
free_page_is_bad mm/page_alloc.c:1067 [inline]
__free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xd3b/0xd90 mm/page_alloc.c:2954
bpf_xdp_shrink_data net/core/filter.c:4411 [inline]
bpf_xdp_frags_shrink_tail+0x4ed/0x800 net/core/filter.c:4435
____bpf_xdp_adjust_tail net/core/filter.c:4457 [inline]
bpf_xdp_adjust_tail+0x1ce/0x210 net/core/filter.c:4450
bpf_prog_5d7dc57dfd7f985a+0x1e/0x24
__bpf_prog_run include/linux/filter.h:807 [inline]
bpf_prog_run_xdp include/net/xdp.h:701 [inline]
bpf_prog_run_generic_xdp+0x612/0x1560 net/core/dev.c:5707
netif_receive_generic_xdp net/core/dev.c:5827 [inline]
do_xdp_generic+0xa95/0x12b0 net/core/dev.c:5889
tun_get_user+0x250d/0x4470 drivers/net/tun.c:1976
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:2104
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5ff5fd8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f3d60e51fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d60e526c0 RCX: 00007f3d5ff5fd8e
RDX: 000000000000fdef RSI: 0000200000001f00 RDI: 00000000000000c8
RBP: 00007f3d60036b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d60226128 R14: 00007f3d60226090 R15: 00007ffefc58be48