Extracting prog: 1m17.852491629s Minimizing prog: 9m2.486443834s Simplifying prog options: 0s Extracting C: 24.619573503s Simplifying C: 7m59.112144677s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program crashed: BUG: Bad page state in skb_pp_cow_data single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r0, 0x0, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, r1, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r0, r1, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, 0x0, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program did not crash testing program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=38.01176976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data simplifying C reproducer testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program did not crash testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program did not crash testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing compiled C program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet program crashed: BUG: Bad page state in skb_pp_cow_data testing program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program crashed: BUG: Bad page state in skb_pp_cow_data validation run: crashed=true testing program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program crashed: BUG: Bad page state in skb_pp_cow_data validation run: crashed=true testing program (duration=38.01176976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) program crashed: BUG: Bad page state in skb_pp_cow_data validation run: crashed=true reproducing took 20m46.320158297s repro crashed as (corrupted=false): BUG: Bad page state in process syz.0.17 pfn:39397 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888039397700 pfn:0x39397 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888039397700 3fffffffffffffff 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774760401, free_ts 63476498804 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_frag_netmem+0x21d/0xa10 net/core/page_pool.c:1079 page_pool_alloc_netmem include/net/page_pool/helpers.h:131 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x507/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3b313 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b313780 pfn:0x3b313 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803b313780 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774752771, free_ts 63476694432 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3bbe9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803bbe9680 pfn:0x3bbe9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803bbe9680 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774746044, free_ts 63476720197 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:26a13 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888026a13b00 pfn:0x26a13 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888026a13b00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774739066, free_ts 63476889667 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:35673 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035673000 pfn:0x35673 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888035673000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774732385, free_ts 63476926394 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3d4e1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d4e1a50 pfn:0x3d4e1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803d4e1a50 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774725990, free_ts 63476937713 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:2dd35 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802dd351e0 pfn:0x2dd35 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88802dd351e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774719578, free_ts 63476953832 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3b02f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b02f000 pfn:0x3b02f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803b02f000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774712849, free_ts 63476974725 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:29e41 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029e41000 pfn:0x29e41 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888029e41000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774706264, free_ts 63476999980 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:346b7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880346b7690 pfn:0x346b7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff8880346b7690 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774699732, free_ts 63477014504 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3d50d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d50de10 pfn:0x3d50d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803d50de10 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774689737, free_ts 63477056079 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:2f7a1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f7a1000 pfn:0x2f7a1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88802f7a1000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774681502, free_ts 63477071338 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 final repro crashed as (corrupted=false): BUG: Bad page state in process syz.0.17 pfn:39397 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888039397700 pfn:0x39397 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888039397700 3fffffffffffffff 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774760401, free_ts 63476498804 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_frag_netmem+0x21d/0xa10 net/core/page_pool.c:1079 page_pool_alloc_netmem include/net/page_pool/helpers.h:131 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x507/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3b313 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b313780 pfn:0x3b313 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803b313780 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774752771, free_ts 63476694432 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3bbe9 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803bbe9680 pfn:0x3bbe9 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803bbe9680 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774746044, free_ts 63476720197 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:26a13 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888026a13b00 pfn:0x26a13 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888026a13b00 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774739066, free_ts 63476889667 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:35673 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035673000 pfn:0x35673 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888035673000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774732385, free_ts 63476926394 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3d4e1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d4e1a50 pfn:0x3d4e1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803d4e1a50 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774725990, free_ts 63476937713 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:2dd35 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802dd351e0 pfn:0x2dd35 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88802dd351e0 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774719578, free_ts 63476953832 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3b02f page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b02f000 pfn:0x3b02f flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803b02f000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774712849, free_ts 63476974725 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:29e41 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029e41000 pfn:0x29e41 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff888029e41000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774706264, free_ts 63476999980 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:346b7 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880346b7690 pfn:0x346b7 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff8880346b7690 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774699732, free_ts 63477014504 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:3d50d page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d50de10 pfn:0x3d50d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88803d50de10 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774689737, free_ts 63477056079 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0 BUG: Bad page state in process syz.0.17 pfn:2f7a1 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802f7a1000 pfn:0x2f7a1 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000040 ffff888022f82000 0000000000000000 raw: ffff88802f7a1000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5905, tgid 5905 (syz.0.17), ts 63774681502, free_ts 63477071338 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 __alloc_pages_noprof mm/page_alloc.c:5338 [inline] alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230 alloc_pages_bulk_node_noprof include/linux/gfp.h:261 [inline] __page_pool_alloc_netmems_slow+0x1c6/0xa60 net/core/page_pool.c:619 page_pool_alloc_netmems net/core/page_pool.c:670 [inline] page_pool_alloc_netmems+0xc4/0x1a0 net/core/page_pool.c:657 page_pool_alloc_netmem include/net/page_pool/helpers.h:128 [inline] page_pool_alloc include/net/page_pool/helpers.h:167 [inline] page_pool_dev_alloc include/net/page_pool/helpers.h:188 [inline] skb_pp_cow_data+0x975/0x1140 net/core/skbuff.c:990 skb_cow_data_for_xdp+0x88/0xb0 net/core/skbuff.c:1024 netif_skb_check_for_xdp net/core/dev.c:5567 [inline] netif_receive_generic_xdp net/core/dev.c:5608 [inline] do_xdp_generic+0x56b/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5588 tgid 5588 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] nlmsg_new include/net/netlink.h:1055 [inline] mpls_netconf_notify_devconf+0x4a/0x100 net/mpls/af_mpls.c:1219 mpls_dev_sysctl_unregister net/mpls/af_mpls.c:1478 [inline] mpls_dev_notify+0x6ce/0x920 net/mpls/af_mpls.c:1693 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12448 unregister_netdevice_many net/core/dev.c:12509 [inline] unregister_netdevice_queue net/core/dev.c:12320 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12310 unregister_netdevice include/linux/netdevice.h:3474 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1422 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2492 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1718 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6226 [inline] hwsim_exit_net+0x88e/0x14f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7207 Modules linked in: CPU: 2 UID: 0 PID: 5905 Comm: syz.0.17 Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 bad_page.cold+0xbe/0xdf mm/page_alloc.c:643 free_page_is_bad mm/page_alloc.c:1078 [inline] free_page_is_bad mm/page_alloc.c:1072 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x7d1/0x1090 mm/page_alloc.c:2950 page_frag_free+0x199/0x1f0 mm/page_frag_cache.c:169 __xdp_return+0x3b6/0x990 net/core/xdp.c:448 bpf_xdp_shrink_data net/core/filter.c:4294 [inline] bpf_xdp_frags_shrink_tail net/core/filter.c:4318 [inline] ____bpf_xdp_adjust_tail net/core/filter.c:4340 [inline] bpf_xdp_adjust_tail+0x8a1/0xbb0 net/core/filter.c:4333 bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 __bpf_prog_run include/linux/filter.h:724 [inline] bpf_prog_run_xdp include/net/xdp.h:696 [inline] bpf_prog_run_generic_xdp+0x614/0x1610 net/core/dev.c:5498 netif_receive_generic_xdp net/core/dev.c:5614 [inline] do_xdp_generic+0x92e/0x12c0 net/core/dev.c:5676 tun_get_user+0x1c1c/0x3c20 drivers/net/tun.c:1874 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2be235e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffd7937e1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555573200500 RCX: 00007f2be235e90e RDX: 000000000000fdef RSI: 00002000000005c0 RDI: 00000000000000c8 RBP: 00007f2be2435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2be2625fac R14: 00007f2be2625fa0 R15: 00007f2be2625fa0