bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P12161/1:b..l P12118/1:b..l
rcu: (detected by 0, t=10502 jiffies, g=78333, q=1696 ncpus=1)
task:syz.3.1291 state:R running task stack:22664 pid:12118 tgid:12118 ppid:5822 task_flags:0x400640 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6908
preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7092
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
_raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:389 [inline]
follow_page_pte+0x8b5/0x1400 mm/gup.c:889
follow_pmd_mask mm/gup.c:928 [inline]
follow_pud_mask mm/gup.c:967 [inline]
follow_p4d_mask mm/gup.c:984 [inline]
follow_page_mask mm/gup.c:1023 [inline]
__get_user_pages+0x745/0x34d0 mm/gup.c:1426
__get_user_pages_locked mm/gup.c:1692 [inline]
get_dump_page+0x27e/0x3d0 mm/gup.c:2192
dump_user_range+0x18d/0xb50 fs/coredump.c:1367
elf_core_dump+0x2d5f/0x3d10 fs/binfmt_elf.c:2110
coredump_write fs/coredump.c:1050 [inline]
do_coredump fs/coredump.c:1127 [inline]
vfs_coredump+0x27bc/0x5570 fs/coredump.c:1201
get_signal+0x1f2a/0x21e0 kernel/signal.c:3019
arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x21000
RSP: 002b:000000000000000c EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007f4cd6616180 RCX: 00007f4cd639c799
RDX: 9999999999999999 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 00007f4cd6432bd9 R08: 0000000000000009 R09: 0000000000000000
R10: ffffffff81000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4cd6616218 R14: 00007f4cd6616180 R15: 00007ffc536bfcf8
task:syz.1.1298 state:R running task stack:23680 pid:12161 tgid:12155 ppid:5826 task_flags:0x400840 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6908
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7235
irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5872
Code: 05 fb e8 28 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 c6 5b f5 0e 0f 82 c2 02 00 00 8b 35 8e 8f f5 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d e8 28 12 0f 85 02 03 00 00 48 83 c4
RSP: 0018:ffffc90003d4e4e8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8de55a23 RDI: ffffffff8c1af720
RBP: ffffffff8e7e9220 R08: 00000000038b6aff R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4515 [inline]
slab_alloc_node mm/slub.c:4844 [inline]
kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4851
cache_alloc_handle mm/zsmalloc.c:379 [inline]
zs_malloc+0xd5/0x13e0 mm/zsmalloc.c:1311
zswap_compress mm/zswap.c:908 [inline]
zswap_store_page mm/zswap.c:1416 [inline]
zswap_store+0x10e1/0x29d0 mm/zswap.c:1527
swap_writeout+0x49d/0x12b0 mm/page_io.c:275
writeout mm/vmscan.c:652 [inline]
pageout mm/vmscan.c:699 [inline]
shrink_folio_list+0x5c4a/0x6000 mm/vmscan.c:1425
reclaim_folio_list+0xdc/0x600 mm/vmscan.c:2205
reclaim_pages+0x428/0x5e0 mm/vmscan.c:2242
madvise_cold_or_pageout_pte_range+0x1635/0x2720 mm/madvise.c:561
walk_pmd_range mm/pagewalk.c:130 [inline]
walk_pud_range mm/pagewalk.c:224 [inline]
walk_p4d_range mm/pagewalk.c:262 [inline]
walk_pgd_range+0xc04/0x1eb0 mm/pagewalk.c:303
__walk_page_range+0x163/0x820 mm/pagewalk.c:411
walk_page_range_vma_unsafe+0x209/0x8f0 mm/pagewalk.c:715
walk_page_range_vma+0x63/0x90 mm/pagewalk.c:725
madvise_pageout_page_range mm/madvise.c:620 [inline]
madvise_pageout+0x259/0x540 mm/madvise.c:645
madvise_vma_behavior+0x3e6/0x3050 mm/madvise.c:1364
madvise_walk_vmas+0x2fe/0xa90 mm/madvise.c:1719
madvise_do_behavior+0x1ea/0x510 mm/madvise.c:1935
do_madvise+0x195/0x240 mm/madvise.c:2028
__do_sys_madvise mm/madvise.c:2037 [inline]
__se_sys_madvise mm/madvise.c:2035 [inline]
__x64_sys_madvise+0xa9/0x110 mm/madvise.c:2035
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f03ae59c799
RSP: 002b:00007f03af4bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f03ae816180 RCX: 00007f03ae59c799
RDX: 0000000000000015 RSI: ffffffffffff0001 RDI: 0000000000000000
RBP: 00007f03ae632bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f03ae816218 R14: 00007f03ae816180 R15: 00007ffc2da1af38
rcu: rcu_preempt kthread starved for 218 jiffies! g78333 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27736 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6908
__schedule_loop kernel/sched/core.c:6990 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7005
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3409 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5872
Code: 05 fb e8 28 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 c6 5b f5 0e 0f 82 c2 02 00 00 8b 35 8e 8f f5 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d e8 28 12 0f 85 02 03 00 00 48 83 c4
RSP: 0018:ffffc90000006428 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000007
RDX: 0000000000000000 RSI: ffffffff8de55a23 RDI: ffffffff8c1af720
RBP: ffffffff8e7e9220 R08: 0000000000f55bef R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88812434c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f31b7bad400 CR3: 000000007a8ac000 CR4: 00000000003526f0
Call Trace:
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2692 [inline]
slab_free mm/slub.c:6143 [inline]
kmem_cache_free+0x124/0x6a0 mm/slub.c:6273
kfree_skbmem+0x19a/0x210 net/core/skbuff.c:1151
__kfree_skb net/core/skbuff.c:1218 [inline]
sk_skb_reason_drop+0x10f/0x1b0 net/core/skbuff.c:1255
packet_rcv+0x16c/0x17b0 net/packet/af_packet.c:2223
dev_queue_xmit_nit+0x6fc/0xa60 net/core/dev.c:2606
xmit_one net/core/dev.c:3867 [inline]
dev_hard_start_xmit+0x2f5/0x7d0 net/core/dev.c:3887
__dev_queue_xmit+0x32c1/0x4800 net/core/dev.c:4840
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
br_dev_queue_push_xmit+0x360/0x550 net/bridge/br_forward.c:53
br_nf_dev_queue_xmit+0x741/0x2a20 net/bridge/br_netfilter_hooks.c:920
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_nf_post_routing+0xcbb/0x16a0 net/bridge/br_netfilter_hooks.c:966
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK include/linux/netfilter.h:316 [inline]
br_forward_finish+0x261/0x4d0 net/bridge/br_forward.c:66
br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
br_nf_forward_finish+0x693/0xb30 net/bridge/br_netfilter_hooks.c:662
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_nf_forward_ip.part.0+0x61e/0x820 net/bridge/br_netfilter_hooks.c:716
br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline]
br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK include/linux/netfilter.h:316 [inline]
__br_forward+0x2f6/0x970 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xf0/0x180 net/bridge/br_forward.c:191
br_flood+0x193/0x650 net/bridge/br_forward.c:238
br_handle_frame_finish+0xf57/0x1f00 net/bridge/br_input.c:229
br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184
br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442
__netif_receive_skb_core.constprop.0+0x6c5/0x3550 net/core/dev.c:6054
__netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6165
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6280
process_backlog+0x37a/0x1580 net/core/dev.c:6631
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7695
napi_poll net/core/dev.c:7758 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7910
handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:395 [inline]
batadv_tt_local_purge+0x21c/0x3d0 net/batman-adv/translation-table.c:1315
batadv_tt_purge+0x8b/0xbd0 net/batman-adv/translation-table.c:3509
process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
process_scheduled_works kernel/workqueue.c:3358 [inline]
rescuer_thread+0x902/0x1490 kernel/workqueue.c:3582
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 1774 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:ec:4a:ef:d2:01, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:ec:4a:ef:d2:01, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
net_ratelimit: 2522 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:ec:4a:ef:d2:01, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:fe:ec:4a:ef:d2:01, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)