[BUG] net: Bad page state in skb_pp_cow_data

From: Jiakai Xu <hidden>
Date: 2025-12-25 02:04:41
Also in: lkml

Hi all,

I have encountered a "Bad page state" bug while fuzzing the kernel.

The issue was initially found on a RISC-V branch. After analyzing the kernel logs, 
I suspected the bug was architecture-independent. To verify this, I reproduced 
it on the latest mainline x86 kernel (commit: ccd1cdca5cd433c8a5dff78b69a79b31d9b77ee1), 
and it reproduced successfully.

The bug appears to be triggered when a Generic XDP program calls bpf_xdp_adjust_tail 
to shrink a packet, causing a page_pool managed page to be incorrectly freed via the 
standard page allocator.

I have uploaded the following materials to GitHub for reference:
- Kernel config files (x86)  
- C reproducer  
- Kernel logs for both x86 and RISC-V  
 
Link: https://github.com/j1akai/temp/tree/main/20251225

Does anyone have suggestions for a fix? I would be very happy to help fix it and 
test any patches.

Best regards, Jiakai

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help