bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-...!: (3 ticks this GP) idle=791c/1/0x4000000000000000 softirq=22642/22643 fqs=2 rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6949/3:b..l rcu: (detected by 0, t=10506 jiffies, g=24293, q=620 ncpus=2) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 6945 Comm: syz.2.351 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline] RIP: 0010:_raw_spin_lock_irqsave+0xc/0x60 kernel/locking/spinlock.c:166 Code: 48 89 df 5b e9 d5 b9 cf f5 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 53 49 89 fe 9c 5b f7 c3 00 02 00 00 74 05 e8 a6 a4 fb f5 bf 01 00 00 00 e8 cc d2 RSP: 0018:ffffc90000a08d08 EFLAGS: 00000092 RAX: 000ffff888033b60 RBX: 0000000000000092 RCX: 00000000000044b8 RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffffff9a995540 RBP: ffffffff9a995538 R08: ffffc90000a08d47 R09: ffffc90000a08d38 R10: dffffc0000000000 R11: fffff520001411a9 R12: 0000000000000001 R13: dffffc0000000000 R14: ffffffff9a995540 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88812504e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f72e6deb580 CR3: 0000000032f1a000 CR4: 0000000000350ef0 Call Trace: debug_object_activate+0xb7/0x420 lib/debugobjects.c:873 debug_hrtimer_activate kernel/time/hrtimer.c:485 [inline] debug_activate kernel/time/hrtimer.c:528 [inline] enqueue_hrtimer+0xa9/0x2c0 kernel/time/hrtimer.c:1109 __run_hrtimer kernel/time/hrtimer.c:2048 [inline] __hrtimer_run_queues+0x4ce/0xa10 kernel/time/hrtimer.c:2096 hrtimer_interrupt+0x448/0x910 kernel/time/hrtimer.c:2215 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:rcu_is_watching+0x72/0xb0 kernel/rcu/tree.c:754 Code: 58 6e 93 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 34 8b 03 65 ff 0d b9 41 c1 11 74 11 83 e0 04 c1 e8 02 5b 41 5e <41> 5f e9 82 62 64 ff cc e8 b1 90 87 ff eb e8 48 c7 c7 c0 01 b6 8e RSP: 0018:ffffc9001e6cf0f0 EFLAGS: 00000212 RAX: 0000000000000001 RBX: ffffffff81b06d2d RCX: 0000000080000001 RDX: 000000002ad94000 RSI: ffffffff8c4bdc60 RDI: ffffffff8c4bdc20 RBP: 0000000000000000 R08: ffffffff81b06d2d R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffff888051c0be00 R13: ffff888078c29540 R14: 00007f3a71f9de99 R15: dffffc0000000000 rcu_read_unlock include/linux/rcupdate.h:869 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] is_module_text_address+0x147/0x1e0 kernel/module/main.c:3923 kernel_text_address+0x94/0xe0 kernel/extable.c:119 __kernel_text_address+0xd/0x30 kernel/extable.c:79 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385 arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] slab_free_hook mm/slub.c:2629 [inline] slab_free mm/slub.c:6377 [inline] kmem_cache_free+0x156/0x650 mm/slub.c:6504 anon_vma_free mm/rmap.c:137 [inline] __put_anon_vma+0x12b/0x2d0 mm/rmap.c:2917 put_anon_vma mm/internal.h:215 [inline] unlink_anon_vmas+0x589/0x730 mm/rmap.c:536 free_pgtables+0x836/0xb70 mm/memory.c:414 exit_mmap+0x4aa/0x9f0 mm/mmap.c:1312 __mmput+0x118/0x420 kernel/fork.c:1187 exit_mm+0x221/0x2d0 kernel/exit.c:615 do_exit+0x6cd/0x2360 kernel/exit.c:997 do_group_exit+0x22d/0x2f0 kernel/exit.c:1152 get_signal+0x121b/0x12c0 kernel/signal.c:3046 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x104/0x730 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a71f9de99 Code: Unable to access opcode bytes at 0x7f3a71f9de6f. RSP: 002b:00007f3a72e260e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a72226098 RCX: 00007f3a71f9de99 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a72226098 RBP: 00007f3a72226090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a72226128 R14: 00007ffd8740f3f0 R15: 00007ffd8740f4d8 task:syz.4.353 state:S stack:26864 pid:6949 tgid:6946 ppid:5625 task_flags:0x400040 flags:0x00080001 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7413 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12 __local_bh_enable_ip+0xe1/0x130 kernel/softirq.c:457 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:914 [inline] __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4913 dev_queue_xmit include/linux/netdevice.h:3446 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:437 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533 sctp_packet_transmit+0x2545/0x2b30 net/sctp/output.c:653 sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline] sctp_outq_flush+0x2e47/0x3300 net/sctp/outqueue.c:1221 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline] sctp_do_sm+0x552a/0x5d50 net/sctp/sm_sideeffect.c:1175 sctp_assoc_bh_rcv+0x3f2/0x630 net/sctp/associola.c:1034 sctp_backlog_rcv+0x15c/0x370 net/sctp/input.c:331 sk_backlog_rcv include/net/sock.h:1190 [inline] __release_sock+0x28b/0x390 net/core/sock.c:3261 release_sock+0x190/0x260 net/core/sock.c:3860 sctp_wait_for_connect+0x37f/0x6e0 net/sctp/socket.c:9419 __sctp_connect+0xaaa/0xdc0 net/sctp/socket.c:1248 sctp_connect net/sctp/socket.c:4828 [inline] sctp_inet_connect+0x12e/0x210 net/sctp/socket.c:4843 __sys_connect_file net/socket.c:2135 [inline] __sys_connect+0x323/0x460 net/socket.c:2154 __do_sys_connect net/socket.c:2160 [inline] __se_sys_connect net/socket.c:2157 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2157 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f243d59de99 RSP: 002b:00007f243e3c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f243d825fa0 RCX: 00007f243d59de99 RDX: 0000000000000010 RSI: 0000200000000200 RDI: 0000000000000004 RBP: 00007f243d633eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f243d826038 R14: 00007f243d825fa0 R15: 00007ffec0123918 rcu: rcu_preempt kthread starved for 10071 jiffies! g24293 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 6941 Comm: syz.0.352 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0x11eb/0x15f0 kernel/smp.c:912 Code: 1e 89 de 83 e6 01 31 ff e8 e2 22 0c 00 83 e3 01 48 bb 00 00 00 00 00 fc ff df 75 07 e8 8e 1e 0c 00 eb 37 f3 90 41 0f b6 04 1c <84> c0 75 10 41 f7 06 01 00 00 00 74 1e e8 73 1e 0c 00 eb e5 44 89 RSP: 0018:ffffc9001e58f580 EFLAGS: 00000293 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888068cbdd00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc9001e58f6c8 R08: ffffffff90579137 R09: 1ffffffff20af226 R10: dffffc0000000000 R11: fffffbfff20af227 R12: 1ffff110170e81d1 R13: ffff8880b863c448 R14: ffff8880b8740e88 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888124f4e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33a2421c CR3: 00000000599c9000 CR4: 0000000000350ef0 Call Trace: on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1077 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline] flush_tlb_mm_range+0x5c4/0x1090 arch/x86/mm/tlb.c:1451 tlb_flush arch/x86/include/asm/tlb.h:23 [inline] tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:509 [inline] tlb_flush_mmu+0x1af/0xa30 mm/mmu_gather.c:423 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1313 __mmput+0x118/0x420 kernel/fork.c:1187 exit_mm+0x221/0x2d0 kernel/exit.c:615 do_exit+0x6cd/0x2360 kernel/exit.c:997 do_group_exit+0x22d/0x2f0 kernel/exit.c:1152 get_signal+0x121b/0x12c0 kernel/signal.c:3046 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x104/0x730 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd0a135e6ce Code: Unable to access opcode bytes at 0x7fd0a135e6a4. RSP: 002b:00007ffc0bd4f358 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: 0000000000000000 RBX: 000055557aac7500 RCX: 00007fd0a135e6ce RDX: 00007ffc0bd4f3b0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fd0a1627da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000296d0 R13: 00007fd0a162609c R14: 0000000000029420 R15: 00007ffc0bd4f4e0 bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) net_ratelimit: 1657 callbacks suppressed bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) net_ratelimit: 2602 callbacks suppressed bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0) bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:19, vlan:0) bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:18, vlan:0)