syzbot

bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P9305/1:b..l P1978/1:b..l P5569/1:b..l
rcu: 	(detected by 1, t=10503 jiffies, g=325389, q=685 ncpus=2)
task:syz.5.9610      state:R  running task     stack:26912 pid:5569  tgid:5569  ppid:1978   task_flags:0x40044c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7095
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 zap_pte_range mm/memory.c:1959 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x3b71/0x48f0 mm/memory.c:2091
 unmap_single_vma mm/memory.c:2133 [inline]
 unmap_vmas+0x48f/0x6a0 mm/memory.c:2171
 exit_mmap+0x280/0xa10 mm/mmap.c:1302
 __mmput+0x118/0x430 kernel/fork.c:1175
 exit_mm+0x168/0x220 kernel/exit.c:581
 do_exit+0x6a2/0x23c0 kernel/exit.c:964
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
 get_signal+0x1284/0x1330 kernel/signal.c:3034
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: d0fb:0x294e66b3c7c44cb4
RSP: 002b:6818c2c748d0790f EFLAGS: 00054a02 ORIG_RAX: ce3d5c200518e753
RAX: 6d02b596a6d6b2c6 RBX: 46b00e13ac8c17fa RCX: 1d6d567492f1521e
RDX: eb30e365dd53f3a0 RSI: c553273f825e1cf7 RDI: b331ef28487276fd
RBP: 9c8c87e20081ee76 R08: cf9d780a350b4549 R09: c7e58b697db8ef3d
R10: d68d02d45a22dc24 R11: 19b4d49ef33da9ed R12: 39cb75b6fa6cb3d1
R13: a8d7b5dbf29d588f R14: 9b8908dcbb4f02b4 R15: 107b9d1451766018
 </TASK>
task:syz-executor    state:R  running task     stack:22632 pid:1978  tgid:1978  ppid:1      task_flags:0x40054c flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7095
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_read_unlock include/linux/rwlock_api_smp.h:254 [inline]
 _raw_read_unlock+0x3f/0x50 kernel/locking/spinlock.c:260
 zap_pid_ns_processes+0x2c9/0x5f0 kernel/pid_namespace.c:233
 find_child_reaper kernel/exit.c:622 [inline]
 forget_original_parent kernel/exit.c:706 [inline]
 exit_notify kernel/exit.c:743 [inline]
 do_exit+0x1f8f/0x23c0 kernel/exit.c:988
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
 get_signal+0x1284/0x1330 kernel/signal.c:3034
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f042135cfce
RSP: 002b:00007f042173fd48 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 0000555578bb0500 RCX: 00007f042135cfce
RDX: 0000000040000000 RSI: 00007f042173fdec RDI: ffffffffffffffff
RBP: 00007f042173fdec R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000001b1
R13: 0000555578bc39f0 R14: 0000000000291676 R15: 00007f042173fe40
 </TASK>
task:syz.5.10661     state:R  running task     stack:25760 pid:9305  tgid:9303  ppid:1978   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7238
 irqentry_exit+0x599/0x620 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__pte_needs_invert arch/x86/include/asm/pgtable-invert.h:18 [inline]
RIP: 0010:protnone_mask arch/x86/include/asm/pgtable-invert.h:24 [inline]
RIP: 0010:pmd_pfn arch/x86/include/asm/pgtable.h:274 [inline]
RIP: 0010:pte_lockptr include/linux/mm.h:3474 [inline]
RIP: 0010:pte_offset_map_lock+0xd0/0x210 mm/pgtable-generic.c:401
Code: 4c 8b 3d fb 3e ff 0b 48 8b 6c 24 30 31 ff 48 89 ee e8 d4 75 aa ff 48 85 ed 41 0f 95 c5 48 89 ee 48 83 e6 01 41 0f 94 c6 31 ff <e8> bb 75 aa ff 45 20 ee 45 0f b6 f6 49 f7 de 49 31 ee 48 89 ee 48
RSP: 0018:ffffc90004a9f4f0 EFLAGS: 00000246
RAX: ffffffff821b2fec RBX: ffff88805e148008 RCX: ffff88807c989e80
RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 00000000764f9067 R08: ffffffff821b2979 R09: ffffffff8e75e520
R10: ffffc90004a9f7ac R11: fffff52000953efe R12: 1ffff1100bc29001
R13: ffff88805e148001 R14: ffffc90004a9f700 R15: ffffea0000000000
 do_anonymous_page mm/memory.c:5242 [inline]
 do_pte_missing+0x9df/0x3490 mm/memory.c:4475
 handle_pte_fault mm/memory.c:6317 [inline]
 __handle_mm_fault mm/memory.c:6455 [inline]
 handle_mm_fault+0x1bec/0x3310 mm/memory.c:6624
 do_user_addr_fault+0x75b/0x1340 arch/x86/mm/fault.c:1385
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:rep_movs_alternative+0x30/0x90 arch/x86/lib/copy_user_64.S:60
Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08
RSP: 0018:ffffc90004a9fa18 EFLAGS: 00050206
RAX: 00007ffffffff001 RBX: 0000000000000038 RCX: 0000000000000038
RDX: 0000000000000001 RSI: 0000200000339000 RDI: ffffc90004a9faa0
RBP: ffffc90004a9fc30 R08: ffffc90004a9fad7 R09: 1ffff92000953f5a
R10: dffffc0000000000 R11: fffff52000953f5b R12: ffffc90004a9fba0
R13: dffffc0000000000 R14: ffffc90004a9faa0 R15: 0000200000339000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:141 [inline]
 _inline_copy_from_user include/linux/uaccess.h:185 [inline]
 _copy_from_user+0x7a/0xb0 lib/usercopy.c:18
 copy_from_user include/linux/uaccess.h:223 [inline]
 copy_msghdr_from_user net/socket.c:2522 [inline]
 recvmsg_copy_msghdr net/socket.c:2778 [inline]
 ___sys_recvmsg+0x175/0x590 net/socket.c:2850
 do_recvmmsg+0x334/0x800 net/socket.c:2949
 __sys_recvmmsg net/socket.c:3023 [inline]
 __do_sys_recvmmsg net/socket.c:3046 [inline]
 __se_sys_recvmmsg net/socket.c:3039 [inline]
 __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f042139c799
RSP: 002b:00007f042224d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f0421616090 RCX: 00007f042139c799
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f0421432c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0421616128 R14: 00007f0421616090 R15: 00007f042173fa48
 </TASK>
net_ratelimit: 35791 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
net_ratelimit: 44576 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:0a:7c:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)