From: Lorenzo Bianconi <lorenzo@kernel.org>
To: syzbot <syzbot+ff145014d6b0ce64a173@syzkaller.appspotmail.com>
Cc: davem@davemloft.net, edumazet@google.com, hawk@kernel.org,
horms@kernel.org, ilias.apalodimas@linaro.org, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com,
toke@redhat.com
Subject: Re: [syzbot] [net?] BUG: Bad page state in skb_pp_cow_data
Date: Mon, 9 Dec 2024 18:15:50 +0100 [thread overview]
Message-ID: <Z1clxqJ2-q4xVRCH@lore-desk> (raw)
In-Reply-To: <6756c37b.050a0220.a30f1.019a.GAE@google.com>
[-- Attachment #1: Type: text/plain, Size: 62928 bytes --]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 7503345ac5f5 Merge tag 'block-6.13-20241207' of git://git...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1784c820580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=335e39020523e2ed
> dashboard link: https://syzkaller.appspot.com/bug?extid=ff145014d6b0ce64a173
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177a8b30580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d80c0f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/21582041bcc6/disk-7503345a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3752facf1019/vmlinux-7503345a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3b1c3c4d3bd9/bzImage-7503345a.xz
>
> The issue was bisected to:
>
> commit e6d5dbdd20aa6a86974af51deb9414cd2e7794cb
> Author: Lorenzo Bianconi <lorenzo@kernel.org>
> Date: Mon Feb 12 09:50:56 2024 +0000
>
> xdp: add multi-buff support for xdp running in generic mode
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=129acb30580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=119acb30580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=169acb30580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ff145014d6b0ce64a173@syzkaller.appspotmail.com
> Fixes: e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode")
>
> BUG: Bad page state in process syz-executor285 pfn:2d302
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d302
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999485029, free_ts 54592867285
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
According to the stack trace above this seems an issue in the page_pool
codebase since we are trying to get a new page from the page allocator
(__page_pool_alloc_pages_slow()) but the new page we receive is already
marked with PP_SIGNATURE in pp_magic field (bad reason is set to "page_pool
leak" in page_bad_reason()) so it already belongs to the pool.
@Jesper, Ilias: any input on it?
Regards,
Lorenzo
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Not tainted 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:2d301
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x8 pfn:0x2d301
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000008 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999478821, free_ts 55944947211
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5810 tgid 5810 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:2d300
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d304000 pfn:0x2d300
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: ffff88802d304000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999472559, free_ts 55944400344
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5810 tgid 5810 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:72d3b
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d3b
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999466297, free_ts 54575113729
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:72d3a
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d3a
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999460106, free_ts 54575122306
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:72d39
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d39
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999453972, free_ts 54575963863
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:72d38
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72d38
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999447572, free_ts 54575218247
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:76907
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76907
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999441200, free_ts 54582364655
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:76906
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76906
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999421067, free_ts 54582851254
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:76905
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76905
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999414838, free_ts 54582871367
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
> BUG: Bad page state in process syz-executor285 pfn:76904
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76904
> flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> raw: 00fff00000000000 dead000000000040 ffff888022ab2000 0000000000000000
> raw: 0000000000000000 0000000000000001 00000000ffffffff 0000000000000000
> page dumped because: page_pool leak
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 5820, tgid 5820 (syz-executor285), ts 62999408239, free_ts 54582895841
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
> prep_new_page mm/page_alloc.c:1564 [inline]
> get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
> __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
> alloc_pages_bulk_noprof+0x70b/0xcc0 mm/page_alloc.c:4699
> alloc_pages_bulk_array_node_noprof include/linux/gfp.h:239 [inline]
> __page_pool_alloc_pages_slow+0x122/0x690 net/core/page_pool.c:538
> page_pool_alloc_netmem net/core/page_pool.c:590 [inline]
> page_pool_alloc_pages+0xd0/0x1c0 net/core/page_pool.c:597
> page_pool_alloc include/net/page_pool/helpers.h:129 [inline]
> page_pool_dev_alloc include/net/page_pool/helpers.h:167 [inline]
> skb_pp_cow_data+0xc43/0x1640 net/core/skbuff.c:983
> netif_skb_check_for_xdp net/core/dev.c:5041 [inline]
> netif_receive_generic_xdp net/core/dev.c:5080 [inline]
> do_xdp_generic+0x505/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> page last free pid 5807 tgid 5807 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1127 [inline]
> free_unref_page+0xde3/0x1130 mm/page_alloc.c:2657
> __folio_put+0x2c7/0x440 mm/swap.c:112
> pipe_buf_release include/linux/pipe_fs_i.h:219 [inline]
> pipe_update_tail fs/pipe.c:224 [inline]
> pipe_read+0x6ed/0x13e0 fs/pipe.c:344
> new_sync_read fs/read_write.c:484 [inline]
> vfs_read+0x991/0xb70 fs/read_write.c:565
> ksys_read+0x18f/0x2b0 fs/read_write.c:708
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Modules linked in:
> CPU: 0 UID: 0 PID: 5820 Comm: syz-executor285 Tainted: G B 6.13.0-rc1-syzkaller-00337-g7503345ac5f5 #0
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> bad_page+0x176/0x1d0 mm/page_alloc.c:501
> free_page_is_bad mm/page_alloc.c:923 [inline]
> free_pages_prepare mm/page_alloc.c:1119 [inline]
> free_unref_page+0x1048/0x1130 mm/page_alloc.c:2657
> bpf_xdp_shrink_data net/core/filter.c:4148 [inline]
> bpf_xdp_frags_shrink_tail+0x3ee/0x7e0 net/core/filter.c:4169
> ____bpf_xdp_adjust_tail net/core/filter.c:4194 [inline]
> bpf_xdp_adjust_tail+0x1c3/0x200 net/core/filter.c:4187
> bpf_prog_f476d5219b92964a+0x1e/0x20
> __bpf_prog_run include/linux/filter.h:701 [inline]
> bpf_prog_run_xdp include/net/xdp.h:514 [inline]
> bpf_prog_run_generic_xdp+0x686/0x1510 net/core/dev.c:4973
> netif_receive_generic_xdp net/core/dev.c:5086 [inline]
> do_xdp_generic+0x757/0xd30 net/core/dev.c:5148
> __netif_receive_skb_core+0x1ce9/0x4690 net/core/dev.c:5492
> __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
> __netif_receive_skb+0x12f/0x650 net/core/dev.c:5785
> netif_receive_skb_internal net/core/dev.c:5871 [inline]
> netif_receive_skb+0x1e8/0x890 net/core/dev.c:5930
> tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550
> tun_get_user+0x30d6/0x4890 drivers/net/tun.c:2007
> tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053
> new_sync_write fs/read_write.c:586 [inline]
> vfs_write+0xaeb/0xd30 fs/read_write.c:679
> ksys_write+0x18f/0x2b0 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f941abf7db0
> Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d f1 e2 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
> RSP: 002b:00007ffc09852f28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f941abf7db0
> RDX: 0000000000011dc0 RSI: 00000000200004c0 RDI: 00000000000000c8
> RBP: 0000000000000000 R08: 00007ffc09853058 R09: 00007ffc09853058
> R10: 00007ffc09853058 R11: 0000000000000202 R12: 00007f941ac460de
> R13: 0000000000000000 R14: 00007ffc09852f60 R15: 00007ffc09852f50
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next prev parent reply other threads:[~2024-12-09 17:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-09 10:16 [syzbot] [net?] BUG: Bad page state in skb_pp_cow_data syzbot
2024-12-09 17:15 ` Lorenzo Bianconi [this message]
2024-12-11 13:41 ` Ilias Apalodimas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z1clxqJ2-q4xVRCH@lore-desk \
--to=lorenzo@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hawk@kernel.org \
--cc=horms@kernel.org \
--cc=ilias.apalodimas@linaro.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+ff145014d6b0ce64a173@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.