bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: br_dev_xmit+0x12ec/0x1550 net/bridge/br_device.c:112

CPU: 1 PID: 21341 Comm: syz-executor0 Not tainted 4.16.0+ #294
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1a7/0x27d lib/dump_stack.c:53
 panic+0x1f8/0x42c kernel/panic.c:183
 __stack_chk_fail+0x22/0x30 kernel/panic.c:643
 br_dev_xmit+0x12ec/0x1550 net/bridge/br_device.c:112
 __netdev_start_xmit include/linux/netdevice.h:4087 [inline]
 netdev_start_xmit include/linux/netdevice.h:4096 [inline]
 xmit_one net/core/dev.c:3053 [inline]
 dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3069
sctp: [Deprecated]: syz-executor4 (pid 21370) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
 __dev_queue_xmit+0x26cf/0x2fd0 net/core/dev.c:3584
sctp: [Deprecated]: syz-executor4 (pid 21373) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
kernel msg: ebtables bug: please report to author: Valid hook without chain
kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher
kernel msg: ebtables bug: please report to author: Valid hook without chain
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617
 neigh_hh_output include/net/neighbour.h:472 [inline]
 neigh_output include/net/neighbour.h:480 [inline]
 ip_finish_output2+0xf4d/0x1550 net/ipv4/ip_output.c:229
sctp: [Deprecated]: syz-executor4 (pid 21390) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
 ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher
 NF_HOOK_COND include/linux/netfilter.h:277 [inline]
 ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
 iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91
 ip_tunnel_xmit+0x16fc/0x3550 net/ipv4/ip_tunnel.c:777
 __gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:449
 gre_tap_xmit+0x2b7/0x510 net/ipv4/ip_gre.c:756
 __netdev_start_xmit include/linux/netdevice.h:4087 [inline]
 netdev_start_xmit include/linux/netdevice.h:4096 [inline]
 xmit_one net/core/dev.c:3053 [inline]
 dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3069
 sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327
 qdisc_restart net/sched/sch_generic.c:399 [inline]
 __qdisc_run+0x676/0x19b0 net/sched/sch_generic.c:410
 __dev_xmit_skb net/core/dev.c:3244 [inline]
 __dev_queue_xmit+0xb8b/0x2fd0 net/core/dev.c:3552
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617
 br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55
 NF_HOOK include/linux/netfilter.h:288 [inline]
 br_forward_finish+0xc8/0x530 net/bridge/br_forward.c:67
 NF_HOOK include/linux/netfilter.h:288 [inline]
 __br_forward+0x533/0xc80 net/bridge/br_forward.c:112
 deliver_clone+0x63/0xc0 net/bridge/br_forward.c:128
 maybe_deliver net/bridge/br_forward.c:169 [inline]
 br_flood+0x612/0x770 net/bridge/br_forward.c:211
 br_dev_xmit+0xa68/0x1550 net/bridge/br_device.c:87
 __netdev_start_xmit include/linux/netdevice.h:4087 [inline]
 netdev_start_xmit include/linux/netdevice.h:4096 [inline]
 xmit_one net/core/dev.c:3053 [inline]
 dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3069
 __dev_queue_xmit+0x26cf/0x2fd0 net/core/dev.c:3584
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617
 neigh_hh_output include/net/neighbour.h:472 [inline]
 neigh_output include/net/neighbour.h:480 [inline]
 ip_finish_output2+0xf4d/0x1550 net/ipv4/ip_output.c:229
 ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
 NF_HOOK_COND include/linux/netfilter.h:277 [inline]
 ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
 iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91
 ip_tunnel_xmit+0x16fc/0x3550 net/ipv4/ip_tunnel.c:777
 __gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:449
 erspan_xmit+0x779/0x22b0 net/ipv4/ip_gre.c:731
 __netdev_start_xmit include/linux/netdevice.h:4087 [inline]
 netdev_start_xmit include/linux/netdevice.h:4096 [inline]
 xmit_one net/core/dev.c:3053 [inline]
 dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3069
 sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327
 qdisc_restart net/sched/sch_generic.c:399 [inline]
 __qdisc_run+0x676/0x19b0 net/sched/sch_generic.c:410
 __dev_xmit_skb net/core/dev.c:3244 [inline]
 __dev_queue_xmit+0xb8b/0x2fd0 net/core/dev.c:3552
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617
 br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55
 br_nf_dev_queue_xmit+0x2f1/0x1690 net/bridge/br_netfilter_hooks.c:777
 NF_HOOK include/linux/netfilter.h:288 [inline]
 br_nf_post_routing+0xc56/0x1570 net/bridge/br_netfilter_hooks.c:823
 nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
 nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
 nf_hook include/linux/netfilter.h:243 [inline]
 NF_HOOK include/linux/netfilter.h:286 [inline]
 br_forward_finish+0x34a/0x530 net/bridge/br_forward.c:67
 br_nf_hook_thresh+0x406/0x560 net/bridge/br_netfilter_hooks.c:1010
 br_nf_forward_finish+0x313/0x670 net/bridge/br_netfilter_hooks.c:551
 NF_HOOK include/linux/netfilter.h:288 [inline]
 br_nf_forward_ip+0xcee/0x1ae0 net/bridge/br_netfilter_hooks.c:618
 nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
 nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
 nf_hook include/linux/netfilter.h:243 [inline]
 NF_HOOK include/linux/netfilter.h:286 [inline]
 __br_forward+0x49c/0xc80 net/bridge/br_forward.c:112
 deliver_clone+0x63/0xc0 net/bridge/br_forward.c:128
 br_flood+0x5c6/0x770 net/bridge/br_forward.c:223
 br_handle_frame_finish+0x5e3/0x15e0 net/bridge/br_input.c:168
 br_nf_hook_thresh+0x406/0x560 net/bridge/br_netfilter_hooks.c:1010
 br_nf_pre_routing_finish+0x87b/0x18e0 net/bridge/br_netfilter_hooks.c:422
 NF_HOOK include/linux/netfilter.h:288 [inline]
 br_nf_pre_routing+0xdbd/0x14b0 net/bridge/br_netfilter_hooks.c:518
 nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
 nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
 nf_hook include/linux/netfilter.h:243 [inline]
 NF_HOOK include/linux/netfilter.h:286 [inline]
 br_handle_frame+0xb5b/0x1740 net/bridge/br_input.c:302
 __netif_receive_skb_core+0x984/0x3480 net/core/dev.c:4546
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4657
 process_backlog+0x203/0x740 net/core/dev.c:5337
 napi_poll net/core/dev.c:5735 [inline]
 net_rx_action+0x788/0x1910 net/core/dev.c:5801
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1045
 </IRQ>
 do_softirq.part.19+0x14d/0x190 kernel/softirq.c:329
 do_softirq kernel/softirq.c:177 [inline]
 __local_bh_enable_ip+0x1ee/0x230 kernel/softirq.c:182
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:728 [inline]
 ip_finish_output2+0x962/0x1550 net/ipv4/ip_output.c:231
 ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
 NF_HOOK_COND include/linux/netfilter.h:277 [inline]
 ip_output+0x1d2/0x860 net/ipv4/ip_output.c:405
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
 ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1421
 ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1441
 raw_sendmsg+0x1d4d/0x26b0 net/ipv4/raw.c:684
 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 __sys_sendto+0x365/0x5a0 net/socket.c:1789
 SYSC_sendto net/socket.c:1801 [inline]
 SyS_sendto+0x40/0x60 net/socket.c:1797
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4552d9
RSP: 002b:00007f4d152e6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f4d152e76d4 RCX: 00000000004552d9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000004f2 R14: 00000000006fa750 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..