| 0/0 |
2026/03/07 12:10 |
flow |
repro |
8m
Results: map[ReproOpts:{ "procs": 1, "repeat": true, "threaded": true, "sandbox": "namespace", "fault_call": -1, "fault_nth": 0 } ReproSyz:r0 = socket(0xa, 0x1, 0x0)
r1 = socket(0x2, 0x2, 0x0)
ioctl$SIOCBRADDBR(r1, 0x89a0, &"bridge0\x00")
r2 = openat(0xffffffffffffff9c, &"dev/net/tun\x00", 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &ifr={name="bridge_slave_0\x00", flags=0x1002})
ioctl$SIOCSIFHWADDR(r1, 0x8924, &ifr={name="bridge_slave_0\x00", ifru_hwaddr={sa_family=0x1, sa_data="\xaa\xaa\xaa\xaa\xaa\x0c"}})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="bridge_slave_0\x00", flags=0x1})
r3 = openat(0xffffffffffffff9c, &"dev/net/tun\x00", 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &ifr={name="veth0_to_bridge\x00", flags=0x1002})
ioctl$SIOCSIFHWADDR(r1, 0x8924, &ifr={name="veth0_to_bridge\x00", ifru_hwaddr={sa_family=0x1, sa_data="\xaa\xaa\xaa\xaa\xaa\x0c"}})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="veth0_to_bridge\x00", flags=0x1})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x2})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x3})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x4})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x5})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x6})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="bridge0\x00", flags=0x41})
write(r2, &"\x33\x33\x00\x00\x00\x01\xaa\xaa\xaa\xaa\xaa\x0c\x86\xdd\x60\x00\x00\x00\x00\x00\x3b\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 0x36)
write(r3, &"\x33\x33\x00\x00\x00\x01\xaa\xaa\xaa\xaa\xaa\x0c\x86\xdd\x60\x00\x00\x00\x00\x00\x3b\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 0x36) SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 1/1 |
2026/03/07 12:10 |
action |
provide-var |
0m
Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 2/1 |
2026/03/07 12:10 |
action |
kernel-checkouter |
0m
Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/ec9e25b392423d2a117ee1d291abb801b14e649f]
|
| 3/1 |
2026/03/07 12:10 |
action |
kernel-builder |
6m
Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/8dcf2ce4d7946b0fb65017066c5b58037e3d6bdc]
|
| 4/1 |
2026/03/07 12:16 |
agent |
crash-repro-finder |
2m
Model:
Results: map[ReproOpts:{ "procs": 1, "repeat": true, "threaded": true, "sandbox": "namespace", "fault_call": -1, "fault_nth": 0 }]
Instruction:
You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
Bug Title: INFO: rcu detected stall in __dentry_kill
Original Crash Report:
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P7776/1:b..l
rcu: (detected by 0, t=10502 jiffies, g=218813, q=1244 ncpus=1)
task:syz.2.15546 state:R running task stack:22896 pid:7776 tgid:7776 ppid:6320 task_flags:0x40064c flags:0x00080001
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6908
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7235
irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:81 [inline]
RIP: 0010:__orc_find+0x86/0xf0 arch/x86/kernel/unwind_orc.c:103
Code: f2 48 d1 fa 48 8d 5c 95 00 48 89 da 48 c1 ea 03 0f b6 34 0a 48 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13 <48> 01 da 49 39 d5 73 af 4c 8d 63 fc 49 39 ec 73 b2 4d 29 f7 49 c1
RSP: 0018:ffffc9000ceb6f00 EFLAGS: 00000246
RAX: ffffffff91894f5e RBX: ffffffff90fd3ec0 RCX: dffffc0000000000
RDX: fffffffff192c3e0 RSI: 0000000000000000 RDI: ffffffff90fd3eb8
RBP: ffffffff90fd3eb8 R08: ffffffff91894f7c R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000019002 R12: ffffffff90fd3ec8
R13: ffffffff829002e4 R14: ffffffff90fd3eb8 R15: ffffffff90fd3eb8
orc_find arch/x86/kernel/unwind_orc.c:238 [inline]
unwind_next_frame+0x2ec/0x1ea0 arch/x86/kernel/unwind_orc.c:510
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:165
__reset_page_owner+0x84/0x190 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
free_unref_folios+0xaea/0x1790 mm/page_alloc.c:3040
folios_put_refs+0x53c/0x840 mm/swap.c:1002
folio_batch_release include/linux/pagevec.h:101 [inline]
shmem_undo_range+0x5e5/0x1570 mm/shmem.c:1149
shmem_truncate_range mm/shmem.c:1277 [inline]
shmem_evict_inode+0x39e/0xbd0 mm/shmem.c:1407
evict+0x3c2/0xad0 fs/inode.c:846
iput_final fs/inode.c:1966 [inline]
iput.part.0+0x605/0xf50 fs/inode.c:2015
iput+0x35/0x40 fs/inode.c:1981
dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
__dentry_kill+0x1d0/0x600 fs/dcache.c:670
finish_dput+0x76/0x480 fs/dcache.c:879
dput.part.0+0x456/0x570 fs/dcache.c:928
dput+0x1f/0x30 fs/dcache.c:920
__fput+0x519/0xb40 fs/file_table.c:477
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x8b8/0x2b60 kernel/exit.c:976
do_group_exit+0xd5/0x2a0 kernel/exit.c:1118
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fe32b39c7a1
RSP: 002b:0000000000005feb EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fe32b615fa0 RCX: 00007fe32b39c799
RDX: 0000000000000000 RSI: 0000000000005feb RDI: 0000000000000002
RBP: 00007fe32b432bd9 R08: 0002000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe32b616038 R14: 00007fe32b615fa0 R15: 00007fffea32d788
</TASK>
rcu: rcu_preempt kthread starved for 2695 jiffies! g218813 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27736 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6908
__schedule_loop kernel/sched/core.c:6990 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7005
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3405 Comm: kworker/R-bat_e Tainted: G U I L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:rcu_is_watching+0x0/0xc0 kernel/rcu/tree.c:748
Code: 3a ff ff ff 48 89 df e8 1e e5 86 00 eb 81 e8 47 e5 86 00 e9 49 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 53 65 ff 05 d3 7b 20 12 e8 7e 40 a0 09 48 c7 c3 a8
RSP: 0018:ffffc90000006cc8 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc900000075a8 RCX: ffffffff9216d201
RDX: ffffc900000075b0 RSI: ffffc90000007578 RDI: ffffc90000006d50
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000095b14 R12: ffffc90000006d90
R13: ffffc90000006d40 R14: ffffc900000075a8 R15: ffffc90000006d74
FS: 0000000000000000(0000) GS:ffff88812434d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb558e4e162 CR3: 0000000037b22000 CR4: 00000000003526f0
Call Trace:
<IRQ>
rcu_read_unlock include/linux/rcupdate.h:879 [inline]
class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0x745/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4542 [inline]
slab_alloc_node mm/slub.c:4869 [inline]
kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4876
skb_ext_maybe_cow net/core/skbuff.c:7092 [inline]
skb_ext_add+0xfa/0x810 net/core/skbuff.c:7167
nf_bridge_unshare net/bridge/br_netfilter_hooks.c:169 [inline]
br_nf_forward_ip.part.0+0x28/0x820 net/bridge/br_netfilter_hooks.c:681
br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline]
br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK include/linux/netfilter.h:316 [inline]
__br_forward+0x2f6/0x970 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xf0/0x180 net/bridge/br_forward.c:191
br_flood+0x193/0x650 net/bridge/br_forward.c:238
br_handle_frame_finish+0xff0/0x1f60 net/bridge/br_input.c:229
br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184
br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442
__netif_receive_skb_core.constprop.0+0x6c5/0x3550 net/core/dev.c:6051
__netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6162
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6277
process_backlog+0x37a/0x1580 net/core/dev.c:6628
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7692
napi_poll net/core/dev.c:7755 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7912
handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
</IRQ>
<TASK>
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:395 [inline]
__batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:185
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline]
batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204
process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
process_scheduled_works kernel/workqueue.c:3358 [inline]
rescuer_thread+0x902/0x1490 kernel/workqueue.c:3582
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
net_ratelimit: 6093 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 8744 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt
Reply: r0 = socket(0xa, 0x1, 0x0)
r1 = socket(0x2, 0x2, 0x0)
ioctl$SIOCBRADDBR(r1, 0x89a0, &"bridge0\x00")
r2 = openat(0xffffffffffffff9c, &"dev/net/tun\x00", 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &ifr={name="bridge_slave_0\x00", flags=0x1002})
ioctl$SIOCSIFHWADDR(r1, 0x8924, &ifr={name="bridge_slave_0\x00", ifru_hwaddr={sa_family=0x1, sa_data="\xaa\xaa\xaa\xaa\xaa\x0c"}})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="bridge_slave_0\x00", flags=0x1})
r3 = openat(0xffffffffffffff9c, &"dev/net/tun\x00", 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &ifr={name="veth0_to_bridge\x00", flags=0x1002})
ioctl$SIOCSIFHWADDR(r1, 0x8924, &ifr={name="veth0_to_bridge\x00", ifru_hwaddr={sa_family=0x1, sa_data="\xaa\xaa\xaa\xaa\xaa\x0c"}})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="veth0_to_bridge\x00", flags=0x1})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x2})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x3})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x4})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x5})
ioctl$SIOCBRADDIF(r1, 0x89a2, &ifr={name="bridge0\x00", ifru_ifindex=0x6})
ioctl$SIOCSIFFLAGS(r1, 0x8914, &ifr={name="bridge0\x00", flags=0x41})
write(r2, &"\x33\x33\x00\x00\x00\x01\xaa\xaa\xaa\xaa\xaa\x0c\x86\xdd\x60\x00\x00\x00\x00\x00\x3b\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 0x36)
write(r3, &"\x33\x33\x00\x00\x00\x01\xaa\xaa\xaa\xaa\xaa\x0c\x86\xdd\x60\x00\x00\x00\x00\x00\x3b\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 0x36)
|
| 5/2 |
2026/03/07 12:16 |
llm |
crash-repro-finder |
2m
Model:
Tokens:
input: 7886
output: 57
thoughts: 16095
Thoughts: **Reproducing the RCU Stall in __dentry_kill**
Okay, so I need to trigger that "INFO: rcu detected stall in __dentry_kill" bug. The crash report points to an RCU stall in a cleanup path after a file operation, specifically involving `__dentry_kill`, `dentry_unlink_inode`, and ultimately, `shmem_evict_inode`. This looks like a race or resource contention during the unlinking of a shared memory inode. The stack trace has the usual suspects: `shmem_truncate_range`, `folio_batch_release`, `reset_page_owner`, the stack walking and KASAN magic. But, the key is the stall, meaning a task has been blocked for too long in a critical section, likely waiting for something to release resources.
The RCU stall is a symptom, the root cause appears to be the RCU GP kthread being starved due to excessive work being done within softirq context, blocking its ability to complete RCU grace periods. Diving into the stack dump of the RCU GP kthread, I see it's starved due to heavy processing in a softirq context related to bridge netfilter and packet flooding (`br_nf_forward`, `br_flood`, etc.). There's a lot of activity in `nf_hook_slow`, `skb_ext_add`, etc. And then there are these log messages, "bridge0: received packet on bridge_slave_0 with own address as source address". That's my breadcrumb trail! The system is flooded with packets on a bridge, and it's getting packets *with its own source address*! That's a classic bridging loop.
To recreate this, I'm thinking a bridge is the key. I need to:
1. Create a bridge.
2. Add some interfaces to the bridge.
3. Enable bridge netfilter – that is important, it's what's generating that softirq storm.
4. Inject packets that cause a loop. Those log messages point to using a veth pair, probably `veth0_to_bridge` and `bridge_slave_0`.
5. The crash report has something about `batadv` and `bat_events` workqueue. Could be involved.
I remember seeing similar cases in syzkaller. There's a `netfilter_bridge.txt`, and another about `socket_netlink_generic_batadv`. I should try using `socket_packet.txt` for packet injection and `socket_netlink_route.txt` for interface configuration.
The log message "received packet on bridge... with own address..." happens in `br_handle_frame_finish` (or `br_fdb_update`). It means a frame has arrived at a port on the bridge *with the source MAC address of that port*. If the bridge then floods that packet, the packet will return.
The flooding part is handled by `br_flood`. If the destination MAC is unknown, it's flooded out of all ports. I need to create this scenario. Send a packet where:
* Src MAC = MAC of the bridge port
* Dst MAC = Unknown (broadcast/multicast)
This causes the flooding, and if it loops, causes the softirq storm and the RCU stall. The bridge processing, especially netfilter, is eating up CPU time. The `batadv_dat_purge` interruption may be only an indicator that the workload is high.
So, I need to focus on this bridge loop. I can inject such packets into the veth, the log messages point to the loop. It's an IPv6 packet from the trace.
I need a syzkaller program to set up this scenario. I'll construct a program that:
1. Creates a bridge.
2. Creates a veth pair (one end enslaved to the bridge).
3. Injects packets.
The best way to inject might be via a packet socket or by writing to a tap device.
I'll check existing syzkaller repros.
I will use netlink calls, particularly `RTM_NEWLINK`. I need to figure out how to specify `IFLA_LINKINFO` to indicate "bridge".
I'll also need to construct the IPv6 packet, and set the MAC address to match what's reported in the logs.
I need to make sure that the network namespace has an IPv6 setup.
The crucial steps are: create a bridge, add an interface to it, and send a packet *with the source MAC matching the interface on the bridge* with a multicast destination to ensure a flood.
I'll start with those and add
|
| 6/2 |
2026/03/07 12:19 |
tool |
set-results |
0m
Args: map[ReproOpts:{ "procs": 1, "repeat": true, "threaded": true, "sandbox": "namespace", "fault_call": -1, "fault_nth": 0 }]
Results: map[ReproOpts:{ "procs": 1, "repeat": true, "threaded": true, "sandbox": "namespace", "fault_call": -1, "fault_nth": 0 }]
|
| 7/2 |
2026/03/07 12:19 |
llm |
crash-repro-finder |
0m
Model:
Tokens:
input: 25118
output: 1159
thoughts: 0
|