bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P19416/1:b..l P19658/1:b..l P19678/1:b..l
rcu: 	(detected by 1, t=10502 jiffies, g=127637, q=397 ncpus=1)
task:syz.1.3185      state:R  running task     stack:28136 pid:19678 tgid:19677 ppid:5826   task_flags:0x400140 flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6929
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7256
 irqentry_exit+0x36/0x90 kernel/entry/common.c:211
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:unwind_next_frame+0x589/0x20a0 arch/x86/kernel/unwind_orc.c:512
Code: f2 40 0f 9e c6 84 d2 0f 95 c2 40 84 d6 0f 85 c8 14 00 00 41 83 e7 07 44 38 f8 0f 9e c2 84 c0 0f 95 c0 84 c2 0f 85 b1 14 00 00 <4c> 89 f2 44 0f b6 79 05 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03
RSP: 0018:ffffc9000345f548 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff912349d2
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffffff909c1acc
RBP: ffffc9000345f600 R08: ffffffff912349d6 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000001163e R12: ffffc9000345f608
R13: ffffc9000345f5b8 R14: ffffc9000345f5ed R15: 0000000000000007
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __set_page_owner+0x91/0x560 mm/page_owner.c:332
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845
 prep_new_page mm/page_alloc.c:1853 [inline]
 get_page_from_freelist+0x10a3/0x3a30 mm/page_alloc.c:3879
 __alloc_frozen_pages_noprof+0x25f/0x2470 mm/page_alloc.c:5178
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
 alloc_frozen_pages_noprof mm/mempolicy.c:2487 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2507
 kimage_alloc_pages+0x74/0x350 kernel/kexec_core.c:283
 kimage_alloc_normal_control_pages kernel/kexec_core.c:357 [inline]
 kimage_alloc_control_pages+0x153/0xa00 kernel/kexec_core.c:470
 kimage_alloc_init kernel/kexec.c:67 [inline]
 do_kexec_load+0x478/0x8a0 kernel/kexec.c:130
 __do_sys_kexec_load kernel/kexec.c:261 [inline]
 __se_sys_kexec_load kernel/kexec.c:242 [inline]
 __x64_sys_kexec_load+0x1bf/0x230 kernel/kexec.c:242
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe5ac38f749
RSP: 002b:00007fe5ad29a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f6
RAX: ffffffffffffffda RBX: 00007fe5ac5e5fa0 RCX: 00007fe5ac38f749
RDX: 0000200000000040 RSI: 0000000000000002 RDI: 0000000000000005
RBP: 00007fe5ac413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe5ac5e6038 R14: 00007fe5ac5e5fa0 R15: 00007ffe5e491448
 </TASK>
task:syz.2.3184      state:R  running task     stack:26168 pid:19658 tgid:19658 ppid:5829   task_flags:0x400040 flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6929
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:7113
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0x107/0x120 kernel/softirq.c:457
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 cfg80211_mlme_unregister_socket+0x270/0x6e0 net/wireless/mlme.c:778
 nl80211_netlink_notify net/wireless/nl80211.c:21499 [inline]
 nl80211_netlink_notify+0x347/0x970 net/wireless/nl80211.c:21471
 notifier_call_chain+0xbc/0x410 kernel/notifier.c:85
 blocking_notifier_call_chain kernel/notifier.c:380 [inline]
 blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:368
 netlink_release+0x16cf/0x2080 net/netlink/af_netlink.c:763
 __sock_release+0xb3/0x270 net/socket.c:662
 sock_close+0x1c/0x30 net/socket.c:1455
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x130 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f579cb8f749
RSP: 002b:00007ffd48e0d078 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f579cde7da0 RCX: 00007f579cb8f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f579cde7da0 R08: 0000000000033014 R09: 0000001d48e0d36f
R10: 00000000003ccdc4 R11: 0000000000000246 R12: 00000000000fdd6a
R13: 00007f579cde6450 R14: ffffffffffffffff R15: 00007ffd48e0d190
 </TASK>
task:syz.1.3137      state:R  running task     stack:22664 pid:19416 tgid:19416 ppid:5826   task_flags:0x40064c flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6929
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7256
 irqentry_exit+0x36/0x90 kernel/entry/common.c:211
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:folio_test_writeback include/linux/page-flags.h:597 [inline]
RIP: 0010:find_lock_entries+0x800/0xbf0 mm/filemap.c:2188
Code: 48 c7 c7 a0 64 99 8b c6 05 d0 f8 75 0e 01 e8 97 4f a3 ff e9 66 fe ff ff e8 ad a4 c7 ff 48 89 ef e8 85 9c 03 00 e9 b2 fc ff ff <e8> 9b a4 c7 ff 48 89 df e8 93 64 fe ff be 08 00 00 00 48 89 c7 48
RSP: 0018:ffffc9000464f310 EFLAGS: 00000246
RAX: ffff88807bef57b8 RBX: ffffea00013b6680 RCX: ffffffff81f4ae43
RDX: 1ffffd4000276cd3 RSI: ffffffff81f4ae51 RDI: ffffea00013b6698
RBP: 0000000000004918 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff920008c9e6b
R13: ffffc9000464f378 R14: fffffffffffffffe R15: 0000000000000001
 shmem_undo_range+0x216/0x1150 mm/shmem.c:1101
 shmem_truncate_range mm/shmem.c:1231 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1359
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1914 [inline]
 iput.part.0+0x6a9/0xb00 fs/inode.c:1966
 iput+0x35/0x40 fs/inode.c:1929
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:466
 __dentry_kill+0x1d0/0x600 fs/dcache.c:669
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:911
 dput+0x1f/0x30 fs/dcache.c:901
 __fput+0x51c/0xb70 fs/file_table.c:476
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x86f/0x2bf0 kernel/exit.c:966
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1107
 get_signal+0x2671/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x790 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:40 [inline]
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 irqentry_exit_to_user_mode+0x176/0x310 kernel/entry/common.c:73
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x100000
RSP: 002b:000000000000000a EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fe5ac5e5fa0 RCX: 00007fe5ac38f749
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000021003b46
RBP: 00007fe5ac413f91 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe5ac5e6038 R14: 00007fe5ac5e5fa0 R15: 00007ffe5e491448
 </TASK>
rcu: rcu_preempt kthread starved for 470 jiffies! g127637 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28376 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6929
 __schedule_loop kernel/sched/core.c:7011 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:7026
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xaf0 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x26d/0x380 kernel/rcu/tree.c:2285
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 3410 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: bat_events batadv_tt_purge
RIP: 0010:__orc_find+0x8e/0xf0 arch/x86/kernel/unwind_orc.c:106
Code: 00 48 89 da 48 c1 ea 03 0f b6 34 0a 48 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13 48 01 da 49 39 d5 73 af <4c> 8d 63 fc 49 39 ec 73 b2 4d 29 f7 49 c1 ff 02 4b 8d 14 7f 48 8d
RSP: 0018:ffffc90000a07c10 EFLAGS: 00000293
RAX: ffffffff9116c62c RBX: ffffffff9093c32c RCX: dffffc0000000000
RDX: ffffffff817ce792 RSI: 0000000000000000 RDI: ffffffff9093c308
RBP: ffffffff9093c328 R08: ffffffff9116c68c R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000007ce7 R12: ffffffff9093c330
R13: ffffffff817ce771 R14: ffffffff9093c308 R15: ffffffff9093c324
FS:  0000000000000000(0000) GS:ffff888124b0d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f67043bdb01 CR3: 0000000024c5c000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
 unwind_next_frame+0x2ec/0x20a0 arch/x86/kernel/unwind_orc.c:494
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2543 [inline]
 slab_free mm/slub.c:6642 [inline]
 kmem_cache_free+0x2d4/0x6c0 mm/slub.c:6752
 skb_kfree_head net/core/skbuff.c:1046 [inline]
 skb_kfree_head net/core/skbuff.c:1043 [inline]
 skb_free_head+0x1b7/0x210 net/core/skbuff.c:1060
 skb_release_data+0x795/0x9e0 net/core/skbuff.c:1087
 skb_release_all net/core/skbuff.c:1152 [inline]
 __kfree_skb net/core/skbuff.c:1166 [inline]
 consume_skb net/core/skbuff.c:1398 [inline]
 consume_skb+0xbf/0x100 net/core/skbuff.c:1392
 netlink_broadcast_filtered+0x3ee/0xf90 net/netlink/af_netlink.c:1537
 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
 nlmsg_multicast include/net/netlink.h:1184 [inline]
 nlmsg_notify+0x9e/0x220 net/netlink/af_netlink.c:2595
 fdb_notify+0xfd/0x1a0 net/bridge/br_fdb.c:199
 br_fdb_update+0x323/0x7c0 net/bridge/br_fdb.c:1036
 br_handle_frame_finish+0xdf1/0x1f00 net/bridge/br_input.c:144
 br_nf_hook_thresh+0x307/0x410 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x76a/0xfc0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x3cd/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xb28/0x14e0 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0xa25/0x4bd0 net/core/dev.c:5966
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6077
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
 process_backlog+0x439/0x15e0 net/core/dev.c:6544
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x97f/0xef0 net/core/dev.c:7784
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 batadv_tt_local_purge+0x21c/0x3c0 net/batman-adv/translation-table.c:1315
 batadv_tt_purge+0x8b/0xb80 net/batman-adv/translation-table.c:3509
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 rescuer_thread+0x620/0xea0 kernel/workqueue.c:3523
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 4948 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 8656 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)