bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P23968/1:b..l P23988/1:b..l
rcu: 	(detected by 1, t=10503 jiffies, g=230017, q=3455 ncpus=2)
task:syz.3.13888     state:R  running task     stack:25976 pid:23988 tgid:23988 ppid:18738  task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5504 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:memset_orig+0x8d/0xb0 arch/x86/lib/memset_64.S:107
Code: e1 38 74 14 c1 e9 03 66 0f 1f 44 00 00 ff c9 48 89 07 48 8d 7f 08 75 f5 83 e2 07 74 0a ff ca 88 07 48 8d 7f 01 75 f6 4c 89 d0 <e9> 4e d7 02 00 48 83 fa 07 76 e3 48 89 07 49 c7 c0 08 00 00 00 4d
RSP: 0018:ffffc90004bf6bb8 EFLAGS: 00000246
RAX: ffffc90004bf6cb8 RBX: ffffc90004bf6cb8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90004bf6cc8
RBP: 1ffffffff21a4182 R08: ffffc90004bf6cc7 R09: 0000000000000000
R10: ffffc90004bf6cb8 R11: fffff5200097ed99 R12: dffffc0000000000
R13: ffffffff90d20c12 R14: ffffc90004bf6c68 R15: ffffc90004bf6cb0
 unwind_next_frame+0xd04/0x2550 arch/x86/kernel/unwind_orc.c:621
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 save_stack+0x122/0x230 mm/page_owner.c:165
 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1397 [inline]
 __free_frozen_pages+0xc0d/0xd20 mm/page_alloc.c:2938
 __slab_free+0x274/0x2c0 mm/slub.c:5672
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4610 [inline]
 slab_alloc_node mm/slub.c:4939 [inline]
 kmem_cache_alloc_noprof+0x2b8/0x650 mm/slub.c:4946
 mt_alloc_one lib/maple_tree.c:139 [inline]
 mas_alloc_nodes+0x291/0x350 lib/maple_tree.c:1089
 mas_preallocate+0x2cf/0x630 lib/maple_tree.c:4961
 vma_iter_prealloc mm/vma.h:577 [inline]
 __split_vma+0x318/0xa50 mm/vma.c:529
 vms_gather_munmap_vmas+0x4e3/0x1370 mm/vma.c:1448
 __mmap_setup mm/vma.c:2439 [inline]
 __mmap_region mm/vma.c:2753 [inline]
 mmap_region+0x909/0x2340 mm/vma.c:2857
 do_mmap+0xc3b/0x10c0 mm/mmap.c:560
 vm_mmap_pgoff+0x272/0x4e0 mm/util.c:581
 ksys_mmap_pgoff+0x4dc/0x760 mm/mmap.c:606
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc81699cbc2
RSP: 002b:00007ffcc2034f98 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fc8147f6000 RCX: 00007fc81699cbc2
RDX: 0000000000000003 RSI: 0000000000400000 RDI: 00007fc8147f6000
RBP: 0000000000000011 R08: 00000000000000db R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000206 R12: 0000000000000003
R13: 0000000000000003 R14: 0000000000000000 R15: 00007fc816c15fa0
 </TASK>
task:syz.2.13881     state:R  running task     stack:25976 pid:23968 tgid:23968 ppid:18329  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5504 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7409
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0xe1/0x130 kernel/softirq.c:457
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 cfg80211_mlme_unregister_socket+0x2c8/0x650 net/wireless/mlme.c:780
 nl80211_netlink_notify+0x356/0x840 net/wireless/nl80211.c:22939
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
 netlink_release+0x11f8/0x1aa0 net/netlink/af_netlink.c:762
 __sock_release net/socket.c:710 [inline]
 sock_close+0xad/0x220 net/socket.c:1501
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1fa/0x730 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4829f9ce59
RSP: 002b:00007ffd9ee5cec8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f482a217da0 RCX: 00007f4829f9ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f482a217da0 R08: 00007f482a216038 R09: 0000000000000000
R10: 00000000003ffd28 R11: 0000000000000246 R12: 00000000000e9ce6
R13: 00007f482a21609c R14: 00000000000e9a3c R15: 00007f482a216090
 </TASK>
rcu: rcu_preempt kthread starved for 213 jiffies! g230017 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28120 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5504 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
 __schedule_loop kernel/sched/core.c:7307 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7322
 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 8848 Comm: kworker/u8:41 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: krds_cp_wq#20/7 rds_connect_worker
RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x70 kernel/kcov.c:213
Code: 00 00 00 48 8b 3d 34 da 61 0c 48 89 de 5b e9 33 f8 5f 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 04 24 65 48 8b 0d d8 49 74 11 65 8b 15 f9 49 74 11 81 e2 00
RSP: 0018:ffffc90000a080d8 EFLAGS: 00000246
RAX: ffffffff8a565e5b RBX: 000000000000001b RCX: 0000000000000003
RDX: 000000000000001b RSI: 0000000000000001 RDI: ffff88807bf254c8
RBP: 0000000000000003 R08: ffffc90000a08420 R09: ffffc90000a08430
R10: ffffc90000a08280 R11: fffff52000141052 R12: 0000000000000003
R13: dffffc0000000000 R14: ffff88807bf254c8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88812537c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558ec224e8 CR3: 000000007bf6e000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 rt6_score_route+0x23/0x380 net/ipv6/route.c:753
 find_match+0x119/0xb40 net/ipv6/route.c:788
 __find_rr_leaf+0x243/0x740 net/ipv6/route.c:872
 find_rr_leaf net/ipv6/route.c:893 [inline]
 rt6_select net/ipv6/route.c:937 [inline]
 fib6_table_lookup+0x3c6/0xae0 net/ipv6/route.c:2255
 ip6_pol_route+0x229/0x14d0 net/ipv6/route.c:2292
 pol_lookup_func include/net/ip6_fib.h:669 [inline]
 __fib6_rule_action net/ipv6/fib6_rules.c:240 [inline]
 fib6_rule_action+0x9d7/0xc00 net/ipv6/fib6_rules.c:278
 fib_rules_lookup+0x770/0xeb0 net/core/fib_rules.c:340
 fib6_rule_lookup+0x1a0/0x730 net/ipv6/fib6_rules.c:115
 ip6_route_input_lookup net/ipv6/route.c:2363 [inline]
 ip6_route_input+0x78d/0xb20 net/ipv6/route.c:2666
 ip6_rcv_finish+0x141/0x280 net/ipv6/ip6_input.c:117
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
 __netif_receive_skb_one_core net/core/dev.c:6206 [inline]
 __netif_receive_skb net/core/dev.c:6319 [inline]
 process_backlog+0x774/0x1860 net/core/dev.c:6670
 __napi_poll+0xaa/0x330 net/core/dev.c:7729
 napi_poll net/core/dev.c:7792 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:7949
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 do_softirq+0x76/0xd0 kernel/softirq.c:523
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
 lock_sock include/net/sock.h:1713 [inline]
 __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292
 kernel_bind+0x13e/0x1c0 net/socket.c:3646
 rds_tcp_conn_path_connect+0x53b/0x920 net/rds/tcp_connect.c:175
 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3397
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3478
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 35106 callbacks suppressed
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)