bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5486/1:b..l P5822/1:b..l P29826/1:b..l rcu: (detected by 0, t=10502 jiffies, g=141697, q=1641 ncpus=1) task:udevd state:R running task stack:27384 pid:29826 tgid:29826 ppid:5191 task_flags:0x40014c flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:56 [inline] RIP: 0010:stack_access_ok+0x7c/0x1d0 arch/x86/kernel/unwind_orc.c:409 Code: 00 0f 85 24 01 00 00 48 8d 7b 10 4c 8b 6b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0b 01 00 00 <48> 8b 43 10 49 39 ed 77 1a 48 39 e8 76 15 4a 8d 54 25 00 48 39 d0 RSP: 0018:ffffc9000c1bf3e0 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffc9000c1bf480 RCX: ffffffff91840c50 RDX: 1ffff92001837e92 RSI: ffffc9000c1bfd68 RDI: ffffc9000c1bf490 RBP: ffffc9000c1bfd68 R08: 0000000000000001 R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000015928 R12: 0000000000000008 R13: ffffc9000c1b8000 R14: ffffc9000c1bfd98 R15: ffffc9000c1bf4b4 deref_stack_reg arch/x86/kernel/unwind_orc.c:419 [inline] unwind_next_frame+0x14f0/0x1ea0 arch/x86/kernel/unwind_orc.c:663 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __reset_page_owner+0x84/0x190 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1432 [inline] free_unref_folios+0xab0/0x16b0 mm/page_alloc.c:3034 folios_put_refs+0x53c/0x840 mm/swap.c:1002 free_pages_and_swap_cache+0x242/0x480 mm/swap_state.c:423 __tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:138 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:398 [inline] tlb_flush_mmu mm/mmu_gather.c:405 [inline] tlb_finish_mmu+0x1b0/0x810 mm/mmu_gather.c:530 exit_mmap+0x3d5/0xd70 mm/mmap.c:1290 __mmput+0x12a/0x410 kernel/fork.c:1174 mmput+0x67/0x80 kernel/fork.c:1197 exit_mm kernel/exit.c:581 [inline] do_exit+0x78a/0x2a30 kernel/exit.c:959 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 __do_sys_exit_group kernel/exit.c:1123 [inline] __se_sys_exit_group kernel/exit.c:1121 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2dc54f16c5 RSP: 002b:00007fff4d7d0358 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000055d84d057040 RCX: 00007f2dc54f16c5 RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000 RBP: 000055d84d035910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff4d7d03a0 R14: 0000000000000000 R15: 0000000000000000 task:syz-executor state:R running task stack:23624 pid:5822 tgid:5822 ppid:5816 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 preempt_schedule_notrace+0x5f/0xd0 kernel/sched/core.c:7184 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13 rcu_is_watching+0x8e/0xc0 kernel/rcu/tree.c:753 rcu_read_unlock include/linux/rcupdate.h:879 [inline] class_rcu_destructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0x745/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __reset_page_owner+0x84/0x190 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1432 [inline] __free_frozen_pages+0x7bb/0x1090 mm/page_alloc.c:2972 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4459 [inline] slab_alloc_node mm/slub.c:4788 [inline] __kmalloc_cache_node_noprof+0x287/0x770 mm/slub.c:5305 kmalloc_node_noprof include/linux/slab.h:1093 [inline] __get_vm_area_node+0x101/0x330 mm/vmalloc.c:3221 __vmalloc_node_range_noprof+0x213/0x1530 mm/vmalloc.c:4024 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4124 alloc_counters net/ipv4/netfilter/ip_tables.c:799 [inline] copy_entries_to_user net/ipv4/netfilter/ip_tables.c:821 [inline] get_entries net/ipv4/netfilter/ip_tables.c:1022 [inline] do_ipt_get_ctl+0x632/0xa10 net/ipv4/netfilter/ip_tables.c:1668 nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x192/0x1e0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0xa1/0x110 net/ipv4/tcp.c:4893 do_sock_getsockopt+0x259/0x3d0 net/socket.c:2383 __sys_getsockopt+0x133/0x1d0 net/socket.c:2412 __do_sys_getsockopt net/socket.c:2419 [inline] __se_sys_getsockopt net/socket.c:2416 [inline] __x64_sys_getsockopt+0xbd/0x160 net/socket.c:2416 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f481979d76a RSP: 002b:00007fff4e57f078 EFLAGS: 00000216 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007fff4e57f100 RCX: 00007f481979d76a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007fff4e57f09c R09: 0000000000000000 R10: 00007fff4e57f100 R11: 0000000000000216 R12: 00007f48199e9960 R13: 00007fff4e57f09c R14: 0000000000000000 R15: 00007f48199ea020 task:dhcpcd state:R running task stack:22520 pid:5486 tgid:5486 ppid:5485 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:81 [inline] RIP: 0010:__orc_find+0x70/0xf0 arch/x86/kernel/unwind_orc.c:103 Code: ec 72 4e 4c 89 e2 48 29 ea 48 89 d6 48 c1 ea 3f 48 c1 fe 02 48 01 f2 48 d1 fa 48 8d 5c 95 00 48 89 da 48 c1 ea 03 0f b6 34 0a <48> 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13 RSP: 0018:ffffc900035b77b0 EFLAGS: 00000a03 RAX: ffffffff922a9e44 RBX: ffffffff9168bca4 RCX: dffffc0000000000 RDX: 1ffffffff22d1794 RSI: 0000000000000000 RDI: ffffffff9168bca4 RBP: ffffffff9168bca4 R08: ffffffff922a9e4a R09: 0000000000000007 R10: 0000000000000200 R11: 00000000000a7d51 R12: ffffffff9168bca4 R13: ffffffff8b7d5185 R14: ffffffff9168bca4 R15: ffffffff9168bca4 orc_find arch/x86/kernel/unwind_orc.c:238 [inline] unwind_next_frame+0x2ec/0x1ea0 arch/x86/kernel/unwind_orc.c:510 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __reset_page_owner+0x84/0x190 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1432 [inline] __free_frozen_pages+0x7bb/0x1090 mm/page_alloc.c:2972 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:406 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] ref_tracker_alloc+0x190/0x590 lib/ref_tracker.c:271 __netns_tracker_alloc include/net/net_namespace.h:367 [inline] netns_tracker_alloc include/net/net_namespace.h:376 [inline] get_net_track include/net/net_namespace.h:393 [inline] sk_alloc+0x2e9/0xe80 net/core/sock.c:2318 unix_create1+0xa6/0x700 net/unix/af_unix.c:1097 unix_create+0x145/0x270 net/unix/af_unix.c:1169 __sock_create+0x339/0x860 net/socket.c:1605 sock_create net/socket.c:1663 [inline] __sys_socketpair+0x261/0x5b0 net/socket.c:1814 __do_sys_socketpair net/socket.c:1863 [inline] __se_sys_socketpair net/socket.c:1860 [inline] __x64_sys_socketpair+0x96/0x100 net/socket.c:1860 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f23a097873a RSP: 002b:00007ffeb011b3e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 000055a588b78000 RCX: 00007f23a097873a RDX: 0000000000000000 RSI: 0000000000080805 RDI: 0000000000000001 RBP: 00007ffeb013b810 R08: 0000000000000000 R09: 0000000000000001 R10: 00007ffeb011b400 R11: 0000000000000246 R12: 00007ffeb011b400 R13: 0000000000000001 R14: 0000000000000000 R15: 000055a57c03aac0 rcu: rcu_preempt kthread starved for 1153 jiffies! g141697 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28376 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 3406 Comm: kworker/R-bat_e Tainted: G U I L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_dat_purge RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline] RIP: 0010:lock_acquire kernel/locking/lockdep.c:5864 [inline] RIP: 0010:lock_acquire+0x129/0x330 kernel/locking/lockdep.c:5825 Code: bd 00 00 00 65 8b 05 3e 30 26 12 85 c0 0f 85 ae 00 00 00 65 48 8b 05 be e8 25 12 8b 90 14 0b 00 00 85 d2 0f 85 98 00 00 00 9c <8f> 04 24 fa 48 c7 c7 d3 51 f6 8d e8 97 fd 9a 09 45 89 e8 44 89 e1 RSP: 0018:ffffc90000006a98 EFLAGS: 00000246 RAX: ffff888032f3dac0 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff81b690d1 RDI: fffffbfff1cfce8c RBP: ffffffff8e7e7460 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000200 R11: 000000000009590e R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124392000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd36204f70 CR3: 0000000033140000 CR4: 00000000003526f0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2670 [inline] slab_free mm/slub.c:6082 [inline] kmem_cache_free+0x124/0x670 mm/slub.c:6212 kfree_skbmem+0x19a/0x210 net/core/skbuff.c:1151 __kfree_skb net/core/skbuff.c:1218 [inline] sk_skb_reason_drop+0x10f/0x1b0 net/core/skbuff.c:1255 kfree_skb_reason include/linux/skbuff.h:1322 [inline] kfree_skb include/linux/skbuff.h:1331 [inline] ip6_mc_input+0x832/0xf50 net/ipv6/ip6_input.c:593 dst_input include/net/dst.h:480 [inline] dst_input include/net/dst.h:478 [inline] ip6_rcv_finish+0x3b1/0x550 net/ipv6/ip6_input.c:79 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:273 NF_HOOK include/linux/netfilter.h:316 [inline] ipv6_rcv+0xa4/0x610 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6149 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6262 netif_receive_skb_internal net/core/dev.c:6348 [inline] netif_receive_skb+0x139/0x760 net/core/dev.c:6407 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70 br_handle_frame_finish+0x84f/0x1f00 net/bridge/br_input.c:235 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0x6c2/0x34f0 net/core/dev.c:6036 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6147 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6262 process_backlog+0x37a/0x1580 net/core/dev.c:6614 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7893 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:395 [inline] __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:185 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline] batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] rescuer_thread+0x902/0x1490 kernel/workqueue.c:3582 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 net_ratelimit: 14804 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) net_ratelimit: 9869 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)