bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P18405/1:b..l
rcu: (detected by 0, t=10503 jiffies, g=84005, q=1595 ncpus=2)
task:syz.4.3106 state:R running task stack:23816 pid:18405 tgid:18397 ppid:17150 task_flags:0x400040 flags:0x00080001
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
preempt_schedule_notrace+0xd1/0x110 kernel/sched/core.c:7206
preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
rcu_lockdep_current_cpu_online+0x107/0x120 kernel/rcu/tree.c:4042
rcu_read_lock_held_common kernel/rcu/update.c:113 [inline]
rcu_read_lock_held+0x1e/0x50 kernel/rcu/update.c:349
task_css include/linux/cgroup.h:459 [inline]
mem_cgroup_from_task+0x9a/0x120 mm/memcontrol.c:884
get_mem_cgroup_from_mm+0xd6/0x2a0 mm/memcontrol.c:937
__mem_cgroup_charge+0x15/0x80 mm/memcontrol.c:4717
mem_cgroup_charge include/linux/memcontrol.h:662 [inline]
shmem_alloc_and_add_folio+0x790/0xf40 mm/shmem.c:1922
shmem_get_folio_gfp+0x59d/0x1660 mm/shmem.c:2535
shmem_fault+0x179/0x390 mm/shmem.c:2736
__do_fault+0x138/0x390 mm/memory.c:5281
do_read_fault mm/memory.c:5716 [inline]
do_fault mm/memory.c:5850 [inline]
do_pte_missing mm/memory.c:4362 [inline]
handle_pte_fault mm/memory.c:6195 [inline]
__handle_mm_fault+0x35e3/0x5400 mm/memory.c:6336
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6505
faultin_page mm/gup.c:1126 [inline]
__get_user_pages+0x165c/0x2a00 mm/gup.c:1428
populate_vma_page_range+0x29f/0x3a0 mm/gup.c:1860
__mm_populate+0x24c/0x380 mm/gup.c:1963
mm_populate include/linux/mm.h:3478 [inline]
vm_mmap_pgoff+0x387/0x4d0 mm/util.c:586
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4e8e58f749
RSP: 002b:00007f4e8f342038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f4e8e7e6270 RCX: 00007f4e8e58f749
RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000
RBP: 00007f4e8e613f91 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4e8e7e6308 R14: 00007f4e8e7e6270 R15: 00007ffe24c95328
rcu: rcu_preempt kthread starved for 1185 jiffies! g84005 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27224 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7026
schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083
rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 13033 Comm: kworker/u8:29 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__lock_is_held kernel/locking/lockdep.c:5598 [inline]
RIP: 0010:lock_is_held_type+0xaf/0x190 kernel/locking/lockdep.c:5940
Code: 00 00 00 7e 48 4c 89 eb 48 81 c3 30 0b 00 00 45 31 ff 49 83 ff 31 73 24 48 89 df 4c 89 f6 e8 78 02 00 00 85 c0 75 2a 49 ff c7 <49> 63 85 28 0b 00 00 48 83 c3 28 49 39 c7 7c d8 eb 11 48 c7 c7 b0
RSP: 0018:ffffc90000a080c8 EFLAGS: 00000002
RAX: 0000000000000000 RBX: ffff88802e47a998 RCX: d7aaaebbe399ba00
RDX: 0000000000000100 RSI: ffffffff8f2cc6c8 RDI: ffff88802e47a998
RBP: 00000000ffffffff R08: ffffc90000a08420 R09: ffffc90000a08430
R10: ffffc90000a08280 R11: fffff52000141052 R12: 0000000000000246
R13: ffff88802e479e40 R14: ffffffff8f2cc6c8 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff888126235000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fddf2c31c50 CR3: 000000000dd38000 CR4: 00000000003526f0
Call Trace:
lock_is_held include/linux/lockdep.h:249 [inline]
lockdep_rtnl_is_held+0x1b/0x40 net/core/rtnetlink.c:182
__in6_dev_get include/net/addrconf.h:347 [inline]
ip6_ignore_linkdown include/net/addrconf.h:448 [inline]
find_match+0xd0/0xc90 net/ipv6/route.c:780
__find_rr_leaf+0x23a/0x6d0 net/ipv6/route.c:868
find_rr_leaf net/ipv6/route.c:889 [inline]
rt6_select net/ipv6/route.c:933 [inline]
fib6_table_lookup+0x39f/0xa80 net/ipv6/route.c:2233
ip6_pol_route+0x222/0x1180 net/ipv6/route.c:2269
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x52f/0x6f0 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2338 [inline]
ip6_route_input+0x6de/0xad0 net/ipv6/route.c:2641
ip6_rcv_finish+0x141/0x2e0 net/ipv6/ip6_input.c:77
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6129 [inline]
__netif_receive_skb+0xd3/0x380 net/core/dev.c:6242
process_backlog+0x622/0x1530 net/core/dev.c:6594
__napi_poll+0xae/0x320 net/core/dev.c:7658
napi_poll net/core/dev.c:7721 [inline]
net_rx_action+0x672/0xe50 net/core/dev.c:7873
handle_softirqs+0x286/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0xd33/0x12d0 kernel/smp.c:877
Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 e6 73 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 91 6f 0b 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 75 6f
RSP: 0018:ffffc9001a44f640 EFLAGS: 00000293
RAX: ffffffff81b4944b RBX: 1ffff11017108489 RCX: ffff88802e479e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9001a44f7c0 R08: ffffffff8f7d0477 R09: 1ffffffff1efa08e
R10: dffffc0000000000 R11: fffffbfff1efa08f R12: ffff8880b8842448
R13: dffffc0000000000 R14: ffff8880b893b400 R15: 0000000000000000
on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043
on_each_cpu include/linux/smp.h:71 [inline]
smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2713 [inline]
smp_text_poke_batch_finish+0x5f9/0x1130 arch/x86/kernel/alternative.c:2923
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x128/0x250 kernel/jump_label.c:210
static_key_enable+0x1a/0x20 kernel/jump_label.c:223
toggle_allocation_gate+0xad/0x240 mm/kfence/core.c:852
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 12688 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:f2:4a:f0:c7:4f:f7, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:f2:4a:f0:c7:4f:f7, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:f2:4a:f0:c7:4f:f7, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
net_ratelimit: 14048 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:f2:4a:f0:c7:4f:f7, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)