Extracting prog: 4m59.080812319s
Minimizing prog: 55m32.434552481s
Simplifying prog options: 0s
Extracting C: 1m45.665275496s
Simplifying C: 26m39.018381404s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program crashed: BUG: Bad page state in corrupted
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r0, 0x0, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={0xffffffffffffffff, r1, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r0, r1, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, 0x0, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program did not crash
testing program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=3m45.462726204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
simplifying C reproducer
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program did not crash
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program did not crash
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
testing program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program crashed: BUG: Bad page state in corrupted
validation run: crashed=true
testing program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program crashed: BUG: Bad page state in corrupted
validation run: crashed=true
testing program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001580)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c)
syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x58, 0x67, 0x0, 0x7, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x1}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x52, 0x0, 0x0, 0x1, 0x4, 0x1}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x3, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x2, {0x7, 0x7, 0x0, 0x1f, 0x0, 0x0, 0x2, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x0)

program crashed: BUG: Bad page state in corrupted
validation run: crashed=true
reproducing took 1h37m25.974521896s
repro crashed as (corrupted=true):
BUG: Bad page state in process syz.1.17  pfn:86183
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86183
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:82a03d80 r5:ddecc22c r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000e r7:00000000 r6:86192f00 r5:0000acee r4:ddecc22c
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000001 r9:00000fef r8:0000000e r7:00000000 r6:86192f00 r5:0000acee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000e r7:86192fb4 r6:86192f00 r5:0000acee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86184
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86184
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc250 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000d r7:00000000 r6:86192f00 r5:00009cee r4:ddecc250
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000002 r9:00001fef r8:0000000d r7:00000000 r6:86192f00 r5:00009cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000d r7:86192fa8 r6:86192f00 r5:00009cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86185
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86185
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc274 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000c r7:00000000 r6:86192f00 r5:00008cee r4:ddecc274
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000003 r9:00002fef r8:0000000c r7:00000000 r6:86192f00 r5:00008cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000c r7:86192f9c r6:86192f00 r5:00008cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86186
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86186
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc298 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000b r7:00000000 r6:86192f00 r5:00007cee r4:ddecc298
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000004 r9:00003fef r8:0000000b r7:00000000 r6:86192f00 r5:00007cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000b r7:86192f90 r6:86192f00 r5:00007cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86187
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86187
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc2bc r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000a r7:00000000 r6:86192f00 r5:00006cee r4:ddecc2bc
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000005 r9:00004fef r8:0000000a r7:00000000 r6:86192f00 r5:00006cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000a r7:86192f84 r6:86192f00 r5:00006cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86188
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86188
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc2e0 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000009 r7:00000000 r6:86192f00 r5:00005cee r4:ddecc2e0
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000006 r9:00005fef r8:00000009 r7:00000000 r6:86192f00 r5:00005cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000009 r7:86192f78 r6:86192f00 r5:00005cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:86189
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x86189
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc304 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000008 r7:00000000 r6:86192f00 r5:00004cee r4:ddecc304
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000007 r9:00006fef r8:00000008 r7:00000000 r6:86192f00 r5:00004cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000008 r7:86192f6c r6:86192f00 r5:00004cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:8618a
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8618a
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc328 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000007 r7:00000000 r6:86192f00 r5:00003cee r4:ddecc328
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000008 r9:00007fef r8:00000007 r7:00000000 r6:86192f00 r5:00003cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000007 r7:86192f60 r6:86192f00 r5:00003cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:8618b
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8618b
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc34c r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000006 r7:00000000 r6:86192f00 r5:00002cee r4:ddecc34c
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000009 r9:00008fef r8:00000006 r7:00000000 r6:86192f00 r5:00002cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000006 r7:86192f54 r6:86192f00 r5:00002cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:8618c
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8618c
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc370 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000005 r7:00000000 r6:86192f00 r5:00001cee r4:ddecc370
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:0000000a r9:00009fef r8:00000005 r7:00000000 r6:86192f00 r5:00001cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000005 r7:86192f48 r6:86192f00 r5:00001cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4
BUG: Bad page state in process syz.1.17  pfn:8618d
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8618d
flags: 0x0(zone=0)
raw: 00000000 00000040 831d6400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 4088 Comm: syz.1.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:86192f00 r5:ddecc394 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000004 r7:00000000 r6:86192f00 r5:00000cee r4:ddecc394
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:0000000b r9:0000afef r8:00000004 r7:00000000 r6:86192f00 r5:00000cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000004 r7:86192f3c r6:86192f00 r5:00000cee r4:df9f1bf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f02727c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df9f3000 r9:df9f1b60 r8:df9f1b6c r7:00000000 r6:816d1978 r5:df9f1bf8
 r4:838679c0
[<7f027214>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:86192000 r7:86192f00 r6:86192100 r5:df9f1bf8 r4:838679c0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:838679c0 r7:df9f1c18 r6:df9f3000 r5:84770c80
 r4:df9f1ccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85ed292c r9:84702000 r8:df9f1d74 r7:828d67d8 r6:824f16f8 r5:84770c80
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85ed292c r9:df9f1e40 r8:84703700 r7:85ed2b0c r6:00000000 r5:84770c80
 r4:84702000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:84770c80 r4:833e5cc0
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:84770c80 r4:833e5cc0
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85ed2b0c r6:00000000 r5:833e5cc0 r4:84702700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:84770c80 r8:85ed2800 r7:84702700 r6:00000000 r5:df9f1ef0
 r4:df9f1f08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df9f1f68 r6:20000180 r5:85906600 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84770c80 r8:8020029c r7:00000000 r6:0000006e r5:85906600
 r4:85906600
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9f1fa8 to 0xdf9f1ff0)
1fa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
1fc0: 00000000 00000000 0000fdef 00000004 003562d8 00000000 00000008 00000000
1fe0: 00000001 7ee34748 0010bc34 0010bcc4

report is corrupted, running repro again
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
report is corrupted, running repro again
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
report is corrupted, running repro again
testing compiled C program (duration=3m45.462726204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet
program crashed: BUG: Bad page state in corrupted
final repro crashed as (corrupted=true):
BUG: Bad page state in process syz-executor135  pfn:85ee8
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85ee8
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:82a03d80 r5:ddec6460 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000e r7:00000000 r6:85ef7f00 r5:0000acee r4:ddec6460
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000001 r9:00000fef r8:0000000e r7:00000000 r6:85ef7f00 r5:0000acee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000e r7:85ef7fb4 r6:85ef7f00 r5:0000acee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85ee9
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85ee9
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec6484 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000d r7:00000000 r6:85ef7f00 r5:00009cee r4:ddec6484
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000002 r9:00001fef r8:0000000d r7:00000000 r6:85ef7f00 r5:00009cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000d r7:85ef7fa8 r6:85ef7f00 r5:00009cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eea
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eea
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec64a8 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000c r7:00000000 r6:85ef7f00 r5:00008cee r4:ddec64a8
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000003 r9:00002fef r8:0000000c r7:00000000 r6:85ef7f00 r5:00008cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000c r7:85ef7f9c r6:85ef7f00 r5:00008cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eeb
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eeb
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec64cc r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000b r7:00000000 r6:85ef7f00 r5:00007cee r4:ddec64cc
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000004 r9:00003fef r8:0000000b r7:00000000 r6:85ef7f00 r5:00007cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000b r7:85ef7f90 r6:85ef7f00 r5:00007cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eec
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eec
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec64f0 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:0000000a r7:00000000 r6:85ef7f00 r5:00006cee r4:ddec64f0
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000005 r9:00004fef r8:0000000a r7:00000000 r6:85ef7f00 r5:00006cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:0000000a r7:85ef7f84 r6:85ef7f00 r5:00006cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eed
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eed
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec6514 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000009 r7:00000000 r6:85ef7f00 r5:00005cee r4:ddec6514
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000006 r9:00005fef r8:00000009 r7:00000000 r6:85ef7f00 r5:00005cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000009 r7:85ef7f78 r6:85ef7f00 r5:00005cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eee
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eee
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec6538 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000008 r7:00000000 r6:85ef7f00 r5:00004cee r4:ddec6538
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000007 r9:00006fef r8:00000008 r7:00000000 r6:85ef7f00 r5:00004cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000008 r7:85ef7f6c r6:85ef7f00 r5:00004cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85eef
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85eef
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec655c r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000007 r7:00000000 r6:85ef7f00 r5:00003cee r4:ddec655c
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000008 r9:00007fef r8:00000007 r7:00000000 r6:85ef7f00 r5:00003cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000007 r7:85ef7f60 r6:85ef7f00 r5:00003cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85ef0
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85ef0
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec6580 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000006 r7:00000000 r6:85ef7f00 r5:00002cee r4:ddec6580
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:00000009 r9:00008fef r8:00000006 r7:00000000 r6:85ef7f00 r5:00002cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000006 r7:85ef7f54 r6:85ef7f00 r5:00002cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85ef1
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85ef1
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec65a4 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000005 r7:00000000 r6:85ef7f00 r5:00001cee r4:ddec65a4
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:0000000a r9:00009fef r8:00000005 r7:00000000 r6:85ef7f00 r5:00001cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000005 r7:85ef7f48 r6:85ef7f00 r5:00001cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94
BUG: Bad page state in process syz-executor135  pfn:85ef2
page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x85ef2
flags: 0x0(zone=0)
raw: 00000000 00000040 833ab400 00000000 00000000 00000001 ffffffff 00000000
raw: 00000000
page dumped because: page_pool leak
Modules linked in:
CPU: 0 UID: 0 PID: 3134 Comm: syz-executor135 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: ARM-Versatile Express
Call trace: 
[<80201a08>] (dump_backtrace) from [<80201afc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:60000013 r6:60000013 r5:8230866c r4:00000000
[<80201ae4>] (show_stack) from [<8021e838>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201ae4>] (show_stack) from [<8021e838>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e7dc>] (dump_stack_lvl) from [<8021e864>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r7:8232c5d8 r6:85ef7f00 r5:ddec65c8 r4:82cd80f0
[<8021e84c>] (dump_stack) from [<8053d9e0>] (bad_page+0x100/0x12c mm/page_alloc.c:647)
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1082 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (free_page_is_bad mm/page_alloc.c:1076 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_pages_prepare mm/page_alloc.c:1409 [inline])
[<8053d8e0>] (bad_page) from [<805413dc>] (__free_frozen_pages+0x708/0x7b8 mm/page_alloc.c:2962)
 r8:00000004 r7:00000000 r6:85ef7f00 r5:00000cee r4:ddec65c8
[<80540cd4>] (__free_frozen_pages) from [<80544e44>] (free_frozen_pages+0x14/0x18 mm/page_alloc.c:2999)
 r10:0000000b r9:0000afef r8:00000004 r7:00000000 r6:85ef7f00 r5:00000cee
 r4:00000000
[<80544e30>] (free_frozen_pages) from [<80549e2c>] (page_frag_free+0x80/0x94 mm/page_frag_cache.c:169)
[<80549dac>] (page_frag_free) from [<816e3f30>] (__xdp_return+0xcc/0x328 net/core/xdp.c:448)
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_shrink_data net/core/filter.c:4383 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_frags_shrink_tail net/core/filter.c:4407 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (____bpf_xdp_adjust_tail net/core/filter.c:4429 [inline])
[<816e3e64>] (__xdp_return) from [<816d1be0>] (bpf_xdp_adjust_tail+0x268/0x34c net/core/filter.c:4422)
 r8:00000004 r7:85ef7f3c r6:85ef7f00 r5:00000cee r4:df96dbf8
[<816d1978>] (bpf_xdp_adjust_tail) from [<7f00fd5c>] (bpf_prog_5d7dc57dfd7f985a+0x68/0x74)
 r10:df95b000 r9:df96db60 r8:df96db6c r7:00000000 r6:816d1978 r5:df96dbf8
 r4:83805cc0
[<7f00fcf4>] (bpf_prog_5d7dc57dfd7f985a) from [<816cb7a4>] (bpf_dispatcher_xdp_func+0x10/0x14 net/core/filter.c:12177)
 r9:0000000e r8:85ef7000 r7:85ef7f00 r6:85ef7100 r5:df96dbf8 r4:83805cc0
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (__bpf_prog_run include/linux/filter.h:779 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_xdp include/net/xdp.h:696 [inline])
[<816cb794>] (bpf_dispatcher_xdp_func) from [<816a1a58>] (bpf_prog_run_generic_xdp+0x12c/0x61c net/core/dev.c:5547)
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (netif_receive_generic_xdp net/core/dev.c:5667 [inline])
[<816a192c>] (bpf_prog_run_generic_xdp) from [<816a236c>] (do_xdp_generic+0x1f4/0x500 net/core/dev.c:5729)
 r10:00000000 r9:0000000e r8:83805cc0 r7:df96dc18 r6:df95b000 r5:85938000
 r4:df96dccc
[<816a2178>] (do_xdp_generic) from [<816a2864>] (__netif_receive_skb_core.constprop.0+0x1ec/0xf64 net/core/dev.c:6075)
 r10:85a1892c r9:846fa000 r8:df96dd74 r7:828d67d8 r6:824f16f8 r5:85938000
 r4:0000059c
[<816a2678>] (__netif_receive_skb_core.constprop.0) from [<816a3894>] (__netif_receive_skb_one_core+0x40/0x84 net/core/dev.c:6263)
 r10:85a1892c r9:df96de40 r8:846fb700 r7:85a18b0c r6:00000000 r5:85938000
 r4:846fa000
[<816a3854>] (__netif_receive_skb_one_core) from [<816a3920>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6378)
 r5:85938000 r4:83804e40
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb_internal net/core/dev.c:6464 [inline])
[<816a3908>] (__netif_receive_skb) from [<816a39a0>] (netif_receive_skb+0x3c/0x268 net/core/dev.c:6523)
 r5:85938000 r4:83804e40
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_rx_batched drivers/net/tun.c:1571 [inline])
[<816a3964>] (netif_receive_skb) from [<80e11f0c>] (tun_get_user+0xd98/0x11ac drivers/net/tun.c:2045)
 r7:85a18b0c r6:00000000 r5:83804e40 r4:846fa700
[<80e11174>] (tun_get_user) from [<80e12c78>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2091)
 r10:81d8a8f0 r9:85938000 r8:85a18800 r7:846fa700 r6:00000000 r5:df96def0
 r4:df96df08
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (new_sync_write fs/read_write.c:595 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write fs/read_write.c:687 [inline])
[<80e12c18>] (tun_chr_write_iter) from [<805b4334>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r8:80e12c18 r7:df96df68 r6:20000180 r5:8383b280 r4:0000fdef
[<805b40b8>] (vfs_write) from [<805b4658>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:85938000 r8:8020029c r7:00000000 r6:0000006e r5:8383b280
 r4:8383b280
[<805b45e4>] (ksys_write) from [<805b46e0>] (__do_sys_write fs/read_write.c:750 [inline])
[<805b45e4>] (ksys_write) from [<805b46e0>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:0000fdef r5:00000000 r4:00000000
[<805b46d0>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   00000000 00000000 000000c8 20000180 0000fdef 00000000
dfc0: 00000000 00000000 0000fdef 00000004 00000900 00000100 00000020 00003a97
dfe0: 00000001 7eb65b40 00045a04 00045a94