syzbot

bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P28248/2:b..l P23164/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=178377, q=968 ncpus=1)
task:syz-executor    state:R  running task     stack:24024 pid:23164 tgid:23164 ppid:23150  task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5260 [inline]
 __schedule+0x1138/0x5ee0 kernel/sched/core.c:6867
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:7051
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 copy_pte_range mm/memory.c:1331 [inline]
 copy_pmd_range mm/memory.c:1392 [inline]
 copy_pud_range mm/memory.c:1429 [inline]
 copy_p4d_range mm/memory.c:1453 [inline]
 copy_page_range+0x22d0/0x6780 mm/memory.c:1535
 dup_mmap+0xbea/0x20e0 mm/mmap.c:1827
 dup_mm kernel/fork.c:1529 [inline]
 copy_mm kernel/fork.c:1581 [inline]
 copy_process+0x3b9f/0x7430 kernel/fork.c:2221
 kernel_clone+0xfc/0x910 kernel/fork.c:2651
 __do_sys_clone+0xce/0x120 kernel/fork.c:2792
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9dfc385f13
RSP: 002b:00007ffe275b3d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9dfc385f13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 0000555560c2c7d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 0000000000175a20 R15: 00007ffe275b3f30
 </TASK>
task:syz.6.4478      state:R  running task     stack:24840 pid:28248 tgid:28242 ppid:23127  task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5260 [inline]
 __schedule+0x1138/0x5ee0 kernel/sched/core.c:6867
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7194
 irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: f6 70 57 00 48 89 df 5b e9 7d 26 5d 00 be 03 00 00 00 5b e9 32 4b ec 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 34 24 65 48 8b 15 48 1e f4 11 65 8b 05 59 1e f4
RSP: 0018:ffffc90005076d60 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff888140ef0000 RCX: ffffffff8b73fbb4
RDX: ffff888052edbd00 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90005076dd8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888052edc830 R12: 0000000000000000
R13: ffff888023c00580 R14: 0000000000000000 R15: 0000000000000001
 xas_load+0x49/0x5b0 lib/xarray.c:250
 xa_load+0xf8/0x2c0 lib/xarray.c:1619
 workingset_test_recent+0x28f/0xe90 mm/workingset.c:459
 workingset_refault+0x5e4/0xca0 mm/workingset.c:566
 __read_swap_cache_async+0x3ea/0x500 mm/swap_state.c:488
 swap_cluster_readahead+0x432/0x770 mm/swap_state.c:646
 shmem_swapin_cluster mm/shmem.c:1745 [inline]
 shmem_swapin_folio+0x1f9f/0x2660 mm/shmem.c:2329
 shmem_get_folio_gfp+0x2c5/0x1610 mm/shmem.c:2489
 shmem_get_folio+0x84/0xb0 mm/shmem.c:2662
 collapse_file+0xd34/0x30e0 mm/khugepaged.c:1927
 hpage_collapse_scan_file+0xdf4/0x1950 mm/khugepaged.c:2387
 madvise_collapse+0x3c9/0xa40 mm/khugepaged.c:2810
 madvise_vma_behavior+0xe8a/0x29e0 mm/madvise.c:1372
 madvise_walk_vmas+0x31f/0xac0 mm/madvise.c:1721
 madvise_do_behavior+0x1e2/0x530 mm/madvise.c:1937
 do_madvise+0x176/0x240 mm/madvise.c:2030
 __do_sys_madvise mm/madvise.c:2039 [inline]
 __se_sys_madvise mm/madvise.c:2037 [inline]
 __x64_sys_madvise+0xa9/0x110 mm/madvise.c:2037
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1eb938f7c9
RSP: 002b:00007f1eba2bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f1eb95e6090 RCX: 00007f1eb938f7c9
RDX: 0000000000000019 RSI: ffffffffffff0005 RDI: 0000000000000000
RBP: 00007f1eb9413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1eb95e6128 R14: 00007f1eb95e6090 R15: 00007ffd19fecee8
 </TASK>
rcu: rcu_preempt kthread starved for 9873 jiffies! g178377 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28328 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5260 [inline]
 __schedule+0x1138/0x5ee0 kernel/sched/core.c:6867
 __schedule_loop kernel/sched/core.c:6949 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6964
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xaf0 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x26d/0x380 kernel/rcu/tree.c:2285
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 6531 Comm: kworker/u8:23 Tainted: G     U       L      syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:lock_is_held_type+0x107/0x150 kernel/locking/lockdep.c:5945
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 5c c0 3c 08 83 f8 01 75 2d 9c 58 f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 2a 03 00 45 31 ed eb
RSP: 0018:ffffc900000068a0 EFLAGS: 00000296
RAX: 0000000000000046 RBX: ffff888052ee2ac8 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8daa5da7 RDI: ffffffff8bf2b400
RBP: ffffffff90145ae8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffff888052ee29b0 R12: ffff888052ee1e80
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff8881248f8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f47a1c49963 CR3: 000000000e184000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lock_is_held include/linux/lockdep.h:249 [inline]
 lockdep_rtnl_is_held+0x1b/0x40 net/core/rtnetlink.c:182
 __in6_dev_get include/net/addrconf.h:347 [inline]
 ip6_ignore_linkdown include/net/addrconf.h:448 [inline]
 find_match+0x34b/0x15d0 net/ipv6/route.c:780
 __find_rr_leaf+0x140/0xe00 net/ipv6/route.c:868
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x57c/0xa30 net/ipv6/route.c:2244
 ip6_pol_route+0x1cc/0x1250 net/ipv6/route.c:2280
 pol_lookup_func include/net/ip6_fib.h:617 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2349 [inline]
 ip6_route_input+0x662/0xc70 net/ipv6/route.c:2652
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish+0x130/0x580 net/ipv6/ip6_input.c:77
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xbe/0x200 net/netfilter/core.c:623
 nf_hook.constprop.0+0x424/0x750 include/linux/netfilter.h:273
 NF_HOOK include/linux/netfilter.h:316 [inline]
 ipv6_rcv+0xa4/0x650 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6152
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6265
 netif_receive_skb_internal net/core/dev.c:6351 [inline]
 netif_receive_skb+0x137/0x760 net/core/dev.c:6410
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0x10e8/0x1f00 net/bridge/br_input.c:235
 br_nf_hook_thresh+0x307/0x410 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x76a/0xfc0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x3cd/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xb28/0x14e0 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0x6b3/0x35b0 net/core/dev.c:6039
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6265
 process_backlog+0x4ab/0x1650 net/core/dev.c:6617
 __napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7681
 napi_poll net/core/dev.c:7744 [inline]
 net_rx_action+0x9f9/0xfa0 net/core/dev.c:7896
 handle_softirqs+0x219/0x950 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x381/0x410 net/core/skbuff.c:674
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:818 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:875 [inline]
 nsim_dev_trap_report_work+0x2b1/0xcf0 drivers/net/netdevsim/dev.c:921
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
net_ratelimit: 14462 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
net_ratelimit: 15364 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:58:ca:49:85:51, vlan:0)