syzbot

bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P14685/1:b..l P15006/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=129357, q=908 ncpus=1)
task:syz.2.2076      state:R  running task     stack:27448 pid:15006 tgid:15000 ppid:5836   task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5387 [inline]
 __schedule+0x10e9/0x6820 kernel/sched/core.c:7188
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7512
 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
 irqentry_exit+0x1fe/0x790 kernel/entry/common.c:164
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__orc_find+0xa6/0xf0 arch/x86/kernel/unwind_orc.c:111
Code: 7c 05 40 84 f6 75 4b 48 63 13 48 01 da 49 39 d5 73 af 4c 8d 63 fc 49 39 ec 73 b2 4d 29 f7 49 c1 ff 02 4b 8d 14 7f 48 8d 04 50 <48> 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f e9 57 70 de 09 48 83 c4
RSP: 0018:ffffc90003987100 EFLAGS: 00000246
RAX: ffffffff9179f06a RBX: ffffffff90f34338 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff90f34338
RBP: ffffffff90f3433c R08: ffffffff9179f094 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000000aedc R12: ffffffff90f34338
R13: ffffffff81aedc52 R14: ffffffff90f34338 R15: 0000000000000000
 orc_find arch/x86/kernel/unwind_orc.c:238 [inline]
 unwind_next_frame+0x2ec/0x2090 arch/x86/kernel/unwind_orc.c:510
 __unwind_start+0x3d1/0x7f0 arch/x86/kernel/unwind_orc.c:787
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0x73/0xf0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5295 [inline]
 __kmalloc_node_track_caller_noprof+0x304/0x850 mm/slub.c:5403
 kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:635
 __alloc_skb+0x185/0x710 net/core/skbuff.c:713
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6734
 sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:2998
 unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2131
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x9e1/0xb70 net/socket.c:2698
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2752
 __sys_sendmmsg+0x205/0x430 net/socket.c:2841
 __do_sys_sendmmsg net/socket.c:2868 [inline]
 __se_sys_sendmmsg net/socket.c:2865 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2865
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffb4f59c819
RSP: 002b:00007ffb5046e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007ffb4f816090 RCX: 00007ffb4f59c819
RDX: 00000000000009a6 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffb4f632c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000007000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffb4f816128 R14: 00007ffb4f816090 R15: 00007ffe29d0fa58
 </TASK>
task:syz.1.2016      state:R  running task     stack:22632 pid:14685 tgid:14685 ppid:5828   task_flags:0x40064c flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5387 [inline]
 __schedule+0x10e9/0x6820 kernel/sched/core.c:7188
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7369
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:190
 spin_unlock include/linux/spinlock.h:390 [inline]
 zap_pte_range mm/memory.c:1948 [inline]
 zap_pmd_range mm/memory.c:2004 [inline]
 zap_pud_range mm/memory.c:2032 [inline]
 zap_p4d_range mm/memory.c:2053 [inline]
 __zap_vma_range+0x1791/0x4bf0 mm/memory.c:2093
 unmap_vmas+0x299/0x5f0 mm/memory.c:2162
 exit_mmap+0x1ef/0xa10 mm/mmap.c:1300
 __mmput+0x12a/0x410 kernel/fork.c:1177
 mmput+0x67/0x80 kernel/fork.c:1200
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x833/0x2a60 kernel/exit.c:965
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:252 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:323 [inline]
 irqentry_exit+0x403/0x790 kernel/entry/common.c:162
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fcc76f9c821
RSP: 002b:0000000080000000 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fcc77215fa0 RCX: 00007fcc76f9c819
RDX: 00002000000000c0 RSI: 0000000080000000 RDI: 0000000000000003
RBP: 00007fcc77032c91 R08: 000000000000008f R09: 0000000000000000
R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc77216038 R14: 00007fcc77215fa0 R15: 00007ffe58fed758
 </TASK>
rcu: rcu_preempt kthread starved for 629 jiffies! g129357 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28216 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5387 [inline]
 __schedule+0x10e9/0x6820 kernel/sched/core.c:7188
 __schedule_loop kernel/sched/core.c:7267 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7282
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3412 Comm: kworker/R-bat_e Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:__find_rr_leaf+0x45a/0x1070 net/ipv6/route.c:832
Code: 0c 15 57 01 31 ff 89 c5 89 c6 e8 61 3e cc f7 85 ed 0f 85 16 01 00 00 e8 a4 43 cc f7 48 85 db 0f 84 92 01 00 00 e8 96 43 cc f7 <48> 8b 44 24 10 48 39 c3 0f 84 7f 01 00 00 e8 83 43 cc f7 48 83 7c
RSP: 0018:ffffc900000074a0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88805e6a3800 RCX: ffffffff8a3bde42
RDX: ffff888035001ec0 RSI: ffffffff8a3bdd2a RDI: ffff888035001ec0
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffd
R13: ffff88805e6ae8df R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124301000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc16ae2100 CR3: 000000000e598000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x50f/0xa10 net/ipv6/route.c:2247
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2283
 pol_lookup_func include/net/ip6_fib.h:667 [inline]
 fib6_rule_lookup+0x52f/0x720 net/ipv6/fib6_rules.c:123
 ip6_route_input_lookup net/ipv6/route.c:2352 [inline]
 ip6_route_input+0x662/0xc50 net/ipv6/route.c:2655
 ip6_rcv_finish_core.isra.0+0x1b1/0x1260 net/ipv6/ip6_input.c:106
 ip6_rcv_finish net/ipv6/ip6_input.c:117 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x1e8/0x3d0 net/ipv6/ip6_input.c:351
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6209
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6322
 process_backlog+0x37a/0x1580 net/core/dev.c:6673
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7737
 napi_poll net/core/dev.c:7800 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7957
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:185
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline]
 batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204
 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
 process_scheduled_works kernel/workqueue.c:3385 [inline]
 rescuer_thread+0x905/0x14a0 kernel/workqueue.c:3609
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 18428 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 17916 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)