bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P28183/1:b..l P344/1:b..l P32702/1:b..l
rcu: (detected by 0, t=10502 jiffies, g=123785, q=2679 ncpus=2)
task:syz.3.7551 state:R running task stack:23656 pid:32702 tgid:32698 ppid:27454 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0xb/0x350 kernel/locking/lockdep.c:5828
Code: 95 c0 e9 88 14 09 0a cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 <41> 54 53 48 83 ec 60 4d 89 ce 45 89 c7 41 89 cc 89 54 24 04 89 f3
RSP: 0018:ffffc900067ffb30 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 000000000496031d RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e959a20
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000000a R11: ffffffff81b10630 R12: ffffea000549a180
R13: 1ffffd4000a93431 R14: ffffffff823b091e R15: 000000a384be672e
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:840 [inline]
__update_page_owner_free_handle+0x4b/0x470 mm/page_owner.c:283
__reset_page_owner+0x85/0x1f0 mm/page_owner.c:321
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1397 [inline]
__free_frozen_pages+0xc0d/0xd20 mm/page_alloc.c:2938
vfree+0x1fd/0x330 mm/vmalloc.c:3472
xskq_destroy+0x40/0x60 net/xdp/xsk_queue.c:64
xsk_release+0x6ff/0x980 net/xdp/xsk.c:1363
__sock_release net/socket.c:710 [inline]
sock_close+0xad/0x220 net/socket.c:1501
__fput+0x418/0xa50 fs/file_table.c:512
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x1fa/0x730 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ff139ce59
RSP: 002b:00007f4fef5ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: 0000000000000000 RBX: 00007f4ff1615fa0 RCX: 00007f4ff139ce59
RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000009
RBP: 00007f4ff1432e6f R08: 0000000000000004 R09: 0000000000000000
R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4ff1616038 R14: 00007f4ff1615fa0 R15: 00007ffdeb0ac958
task:syz.1.7577 state:R running task stack:26520 pid:344 tgid:342 ppid:26526 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__asan_memset+0x31/0x50 mm/kasan/shadow.c:87
Code: 53 48 89 d3 89 f5 49 89 fe 48 8b 4c 24 18 48 89 d6 ba 01 00 00 00 e8 1e e5 ff ff 84 c0 74 11 4c 89 f7 89 ee 48 89 da 5b 41 5e <5d> e9 c9 ae 76 09 31 c0 5b 41 5e 5d e9 ce 86 79 09 cc 66 66 66 66
RSP: 0018:ffffc9000679f050 EFLAGS: 00000202
RAX: ffffc9000679ff01 RBX: ffffc9000679f158 RCX: ffffffff8176ae94
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc9000679f158
RBP: 0000000000000000 R08: ffffc9000679f167 R09: 1ffff92000cf3e2c
R10: dffffc0000000000 R11: fffff52000cf3e2d R12: dffffc0000000000
R13: ffffffff916cde7a R14: ffffc9000679f108 R15: ffffc9000679f150
unwind_next_frame+0xd04/0x2550 arch/x86/kernel/unwind_orc.c:621
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
save_stack+0x122/0x230 mm/page_owner.c:165
__reset_page_owner+0x71/0x1f0 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1397 [inline]
__free_frozen_pages+0xc0d/0xd20 mm/page_alloc.c:2938
__slab_free+0x274/0x2c0 mm/slub.c:5672
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4610 [inline]
slab_alloc_node mm/slub.c:4939 [inline]
__kmalloc_cache_node_noprof+0x37b/0x690 mm/slub.c:5459
_kmalloc_node_noprof include/linux/slab.h:1170 [inline]
__get_vm_area_node+0x136/0x300 mm/vmalloc.c:3215
__vmalloc_node_range_noprof+0x358/0x1730 mm/vmalloc.c:4024
__vmalloc_node_noprof mm/vmalloc.c:4124 [inline]
__vmalloc_area_node mm/vmalloc.c:3854 [inline]
__vmalloc_node_range_noprof+0x5b1/0x1730 mm/vmalloc.c:4064
__vmalloc_node_noprof mm/vmalloc.c:4124 [inline]
vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4202
alloc_one_pg_vec_page net/packet/af_packet.c:4377 [inline]
alloc_pg_vec net/packet/af_packet.c:4402 [inline]
packet_set_ring+0x71a/0x2470 net/packet/af_packet.c:4487
packet_setsockopt+0xd9c/0x1510 net/packet/af_packet.c:3845
do_sock_setsockopt+0x17c/0x1b0 net/socket.c:2368
__sys_setsockopt net/socket.c:2393 [inline]
__do_sys_setsockopt net/socket.c:2399 [inline]
__se_sys_setsockopt net/socket.c:2396 [inline]
__x64_sys_setsockopt+0x13d/0x1b0 net/socket.c:2396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc56499ce59
RSP: 002b:00007fc565910028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007fc564c15fa0 RCX: 00007fc56499ce59
RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000006
RBP: 00007fc564a32e6f R08: 000000000000001c R09: 0000000000000000
R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc564c16038 R14: 00007fc564c15fa0 R15: 00007ffc4f7cd5d8
task:syz-executor state:R running task stack:22664 pid:28183 tgid:28183 ppid:28175 task_flags:0x400140 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:memset_orig+0x15/0xb0 arch/x86/lib/memset_64.S:57
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01 48 0f af c1 <41> 89 f9 41 83 e1 07 75 74 48 89 d1 48 c1 e9 06 74 39 66 0f 1f 84
RSP: 0018:ffffc90006fc70d8 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffffc90006fc71d8 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc90006fc71d8
RBP: 1ffffffff21a9dcc R08: ffffc90006fc71e7 R09: 1ffff92000df8e3c
R10: ffffc90006fc71d8 R11: fffff52000df8e3d R12: dffffc0000000000
R13: ffffffff90d4ee60 R14: ffffc90006fc7188 R15: ffffc90006fc71d0
unwind_next_frame+0xd04/0x2550 arch/x86/kernel/unwind_orc.c:621
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
save_stack+0x122/0x230 mm/page_owner.c:165
__reset_page_owner+0x71/0x1f0 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1397 [inline]
__free_frozen_pages+0xc0d/0xd20 mm/page_alloc.c:2938
__slab_free+0x274/0x2c0 mm/slub.c:5672
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_kmalloc+0x22/0xb0 mm/kasan/common.c:406
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x358/0x750 mm/slub.c:5347
_kmalloc_noprof include/linux/slab.h:973 [inline]
_kzalloc_noprof include/linux/slab.h:1286 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x2ad/0x570 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x5fa/0x640 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x229/0x470 security/tomoyo/file.c:776
security_file_open+0xa9/0x240 security/security.c:2739
do_dentry_open+0x4a0/0x1380 fs/open.c:924
vfs_open+0x3b/0x340 fs/open.c:1079
do_open fs/namei.c:4700 [inline]
path_openat+0x2e44/0x3830 fs/namei.c:4859
do_file_open+0x23e/0x4a0 fs/namei.c:4888
do_sys_openat2+0x115/0x200 fs/open.c:1395
do_sys_open fs/open.c:1401 [inline]
__do_sys_openat fs/open.c:1417 [inline]
__se_sys_openat fs/open.c:1412 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1412
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff355b9c17c
RSP: 002b:00007ffc5b7411b0 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff355c322ca RCX: 00007ff355b9c17c
RDX: 0000000000090800 RSI: 00007ffc5b742360 RDI: 00000000ffffff9c
RBP: 00007ffc5b74234c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc5b742360
R13: 00007ff355c322ca R14: 000000000008d1ba R15: 00007ffc5b7423a0
rcu: rcu_preempt kthread starved for 2276 jiffies! g123785 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28056 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
__schedule_loop kernel/sched/core.c:7307 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7322
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3226 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:kasan_quarantine_put+0x6a/0x1f0 mm/kasan/quarantine.c:237
Code: 98 8f 3b 93 01 75 32 41 f7 c7 00 02 00 00 74 05 e8 5b ca 9c ff 9c 58 a9 00 02 00 00 75 78 41 f7 c7 00 02 00 00 74 01 fb 31 c0 <5b> 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 8d 80 80 8f 3b 93
RSP: 0018:ffffc90000007310 EFLAGS: 00000206
RAX: 0000000000000001 RBX: ffff8881f38e63c0 RCX: 0000000080000102
RDX: 0000000000000000 RSI: ffffffff8c291100 RDI: ffffffff823158fb
RBP: 0000000000000000 R08: ffffffff903117f7 R09: 1ffffffff20622fe
R10: dffffc0000000000 R11: fffffbfff20622ff R12: ffff8881f38e63c0
R13: 0000000000000000 R14: 00000000000da500 R15: 0000000000000286
FS: 0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdaa5bfe4ac CR3: 0000000032536000 CR4: 00000000003526f0
Call Trace:
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2700 [inline]
slab_free mm/slub.c:6310 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6437
kfree_skb_reason include/linux/skbuff.h:1325 [inline]
kfree_skb include/linux/skbuff.h:1334 [inline]
mrp_rcv+0x1588/0x1840 net/802/mrp.c:836
__netif_receive_skb_one_core net/core/dev.c:6206 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
netif_receive_skb_internal net/core/dev.c:6405 [inline]
netif_receive_skb+0x4af/0xbf0 net/core/dev.c:6464
NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:318
br_handle_frame_finish+0x1192/0x1990 net/bridge/br_input.c:-1
nf_hook_bridge_pre net/bridge/br_input.c:313 [inline]
br_handle_frame+0x81b/0x1510 net/bridge/br_input.c:442
__netif_receive_skb_core+0x989/0x30b0 net/core/dev.c:6093
__netif_receive_skb_one_core net/core/dev.c:6204 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
process_backlog+0x706/0x1860 net/core/dev.c:6670
__napi_poll+0xaa/0x330 net/core/dev.c:7729
napi_poll net/core/dev.c:7792 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:7949
handle_softirqs+0x225/0x840 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:396 [inline]
batadv_tt_local_purge+0x2c1/0x340 net/batman-adv/translation-table.c:1363
batadv_tt_purge+0x35/0xa10 net/batman-adv/translation-table.c:3557
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3397
rescuer_thread+0x7b6/0x10b0 kernel/workqueue.c:3621
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 53878 callbacks suppressed
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)