linux-kernel - [BUG] net: Bad page state in skb_pp_cow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <338e2eb7.723e4.19b53391fa8.Coremail.xujiakai24@mails.ucas.ac.cn>
Date: Thu, 25 Dec 2025 09:56:51 +0800 (GMT+08:00)
From: "Jiakai Xu" <xujiakai24@...ls.ucas.ac.cn>
To: linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Cc: horms@...nel.org, pabeni@...hat.com, kuba@...nel.org, 
	edumazet@...gle.com, davem@...emloft.net
Subject: [BUG] net: Bad page state in skb_pp_cow_data

Hi all,

I have encountered a "Bad page state" bug while fuzzing the kernel.

The issue was initially found on a RISC-V branch. After analyzing the kernel logs, 
I suspected the bug was architecture-independent. To verify this, I reproduced 
it on the latest mainline x86 kernel (commit: ccd1cdca5cd433c8a5dff78b69a79b31d9b77ee1), 
and it reproduced successfully.

The bug appears to be triggered when a Generic XDP program calls bpf_xdp_adjust_tail 
to shrink a packet, causing a page_pool managed page to be incorrectly freed via the 
standard page allocator.

I have uploaded the following materials to GitHub for reference:
- Kernel config files (x86)  
- C reproducer  
- Kernel logs for both x86 and RISC-V  

Link: https://github.com/j1akai/temp/tree/main/20251225

Does anyone have suggestions for a fix? I would be very happy to help fix it and 
test any patches.

Best regards, Jiakai