icmp: detected local route for 10.128.1.164 during ICMP sending, src 10.128.0.163 icmp: detected local route for 10.128.1.164 during ICMP sending, src 10.128.0.163 rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 1-....: (1 GPs behind) idle=b06c/1/0x4000000000000000 softirq=163317/163318 fqs=4479 rcu: hardirqs softirqs csw/system rcu: number: 888240 0 0 rcu: cputime: 28895 23594 104 ==> 52490(ms) rcu: (t=10500 jiffies g=255933 q=821 ncpus=2) CPU: 1 PID: 31752 Comm: syz.0.8097 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 0b c9 cd f6 65 8b 05 2c f8 74 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc900001f0040 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 1d1d6623fe5ab300 RDX: dffffc0000000000 RSI: ffffffff8acac960 RDI: 0000000000000001 RBP: ffffc900001f00c0 R08: ffffffff911c15f7 R09: 1ffffffff22382be R10: dffffc0000000000 R11: fffffbfff22382bf R12: dffffc0000000000 R13: ffff888060033c80 R14: ffffffff974cbf20 R15: 1ffff9200003e008 FS: 00007f0b73fac6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33421ff8 CR3: 00000000668cb000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000200000000300 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __debug_check_no_obj_freed lib/debugobjects.c:999 [inline] debug_check_no_obj_freed+0x51f/0x540 lib/debugobjects.c:1020 slab_free_hook mm/slub.c:1786 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] kmem_cache_free+0xf8/0x270 mm/slub.c:3852 geneve_xmit+0x2837/0x3540 drivers/net/geneve.c:1127 __netdev_start_xmit include/linux/netdevice.h:4943 [inline] netdev_start_xmit include/linux/netdevice.h:4957 [inline] xmit_one net/core/dev.c:3632 [inline] dev_hard_start_xmit+0x246/0x740 net/core/dev.c:3648 __dev_queue_xmit+0x19a3/0x3660 net/core/dev.c:4442 neigh_output include/net/neighbour.h:543 [inline] ip6_finish_output2+0xe3d/0x1630 net/ipv6/ip6_output.c:141 dst_output include/net/dst.h:467 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ndisc_send_skb+0xc26/0x14f0 net/ipv6/ndisc.c:513 addrconf_rs_timer+0x2d5/0x630 net/ipv6/addrconf.c:4024 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x542/0x800 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x280/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:finish_task_switch+0x26a/0x8f0 kernel/sched/core.c:5255 Code: 0f 84 33 01 00 00 48 85 db 0f 85 52 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 00 54 31 09 e8 9b 23 30 00 fb 4c 8b 65 c0 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 RSP: 0018:ffffc900174a7ad8 EFLAGS: 00000286 RAX: 1d1d6623fe5ab300 RBX: 0000000000000000 RCX: 1d1d6623fe5ab300 RDX: dffffc0000000000 RSI: ffffffff8acac960 RDI: ffffffff8b1c85a0 RBP: ffffc900174a7b30 R08: ffffffff8e8aeeef R09: 1ffffffff1d15ddd R10: dffffc0000000000 R11: fffffbfff1d15dde R12: ffff88802a2b8000 R13: dffffc0000000000 R14: ffff88801c243c00 R15: ffff8880b8f3cac8 context_switch kernel/sched/core.c:5384 [inline] __schedule+0x155b/0x45a0 kernel/sched/core.c:6700 preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7010 irqentry_exit+0x67/0x70 kernel/entry/common.c:438 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:exit_to_user_mode_loop+0x40/0x110 kernel/entry/common.c:164 Code: fb eb 1d e8 32 53 11 09 65 48 8b 05 ba df 8f 7e 4c 8b 30 41 f7 c6 0e 30 02 00 0f 84 c4 00 00 00 e8 15 b6 19 00 fb 41 f6 c6 08 <74> 05 e8 29 7e 19 09 41 f7 c6 00 10 00 00 74 08 48 89 df e8 18 94 RSP: 0018:ffffc900174a7ed0 EFLAGS: 00000246 RAX: 1d1d6623fe5ab300 RBX: ffffc900174a7f58 RCX: 1d1d6623fe5ab300 RDX: dffffc0000000000 RSI: ffffffff8acac960 RDI: ffffffff8b1c85a0 RBP: ffffc900174a7f48 R08: ffffffff8e8aeeef R09: 1ffffffff1d15ddd R10: dffffc0000000000 R11: fffffbfff1d15dde R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000004002 R15: ffff88802a2b8000 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f0b7319c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0b73fac028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000004 RBX: 00007f0b73415fa0 RCX: 00007f0b7319c799 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000480 RBP: 00007f0b73232c99 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0b73416038 R14: 00007f0b73415fa0 R15: 00007ffc5b296278