bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:be:3c:22:7a:05:47, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:be:3c:22:7a:05:47, vlan:0) rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (10485 ticks this GP) idle=d2e/1/0x4000000000000004 softirq=47659/47683 fqs=35 rcu: (t=10501 jiffies g=4521 q=1) rcu: rcu_sched kthread starved for 4567 jiffies! g4521 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: RCU grace-period kthread stack dump: rcu_sched R running task 29760 11 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_timeout+0x4cf/0xfe0 kernel/time/timer.c:1818 rcu_gp_kthread+0xdad/0x21c0 kernel/rcu/tree.c:2202 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 NMI backtrace for cpu 0 CPU: 0 PID: 23057 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x15f/0x19c kernel/rcu/tree.c:1340 print_cpu_stall kernel/rcu/tree.c:1478 [inline] check_cpu_stall kernel/rcu/tree.c:1550 [inline] __rcu_pending kernel/rcu/tree.c:3293 [inline] rcu_pending kernel/rcu/tree.c:3336 [inline] rcu_check_callbacks.cold+0x62d/0xe19 kernel/rcu/tree.c:2682 update_process_times+0x2a/0x70 kernel/time/timer.c:1650 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:168 tick_sched_timer+0xfc/0x290 kernel/time/tick-sched.c:1278 __run_hrtimer kernel/time/hrtimer.c:1465 [inline] __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:rcu_is_watching+0x2/0xc0 kernel/rcu/tree.c:1021 Code: e9 24 f4 ff ff 48 8b bc 24 a8 00 00 00 e8 f6 d7 46 00 e9 f4 f3 ff ff 48 8b 7c 24 18 e8 07 d9 46 00 e9 c8 f3 ff ff 66 90 55 53 <48> 83 ec 08 65 ff 05 13 53 b0 7e e8 2e 94 25 02 48 c7 c3 c0 2a 02 RSP: 0018:ffff8880ba006ba0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: ffff8880949f6400 RCX: 1ffffffff148be2c RDX: 0000000000000000 RSI: ffffffff87097e49 RDI: ffff8880949f6c84 RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880951823c0 R13: 0000000000000000 R14: ffff8880ba006c60 R15: 0000000000000000 rcu_read_lock_held+0xba/0x110 kernel/rcu/update.c:283 fib6_node_lookup_1+0x60e/0x910 net/ipv6/ip6_fib.c:1429 fib6_node_lookup+0xbe/0x170 net/ipv6/ip6_fib.c:1485 fib6_table_lookup+0xb3/0xf40 net/ipv6/route.c:1869 ip6_pol_route+0x180/0x1270 net/ipv6/route.c:1909 fib6_rule_lookup+0x10b/0x4e0 net/ipv6/fib6_rules.c:118 ip6_route_input_lookup net/ipv6/route.c:1990 [inline] ip6_route_input+0x6c0/0xaa0 net/ipv6/route.c:2125 ip6_rcv_finish_core.constprop.0.isra.0+0xd7/0x550 net/ipv6/ip6_input.c:63 ip6_rcv_finish+0x176/0x2f0 net/ipv6/ip6_input.c:74 ip_sabotage_in net/bridge/br_netfilter_hooks.c:847 [inline] ip_sabotage_in+0x17d/0x1d0 net/bridge/br_netfilter_hooks.c:841 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] NF_HOOK include/linux/netfilter.h:287 [inline] ipv6_rcv+0x26a/0x3f0 net/ipv6/ip6_input.c:273 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 netif_receive_skb_internal+0xf0/0x3f0 net/core/dev.c:5156 NF_HOOK include/linux/netfilter.h:289 [inline] br_pass_frame_up+0x309/0x6c0 net/bridge/br_input.c:69 br_handle_frame_finish+0x6f2/0x1410 net/bridge/br_input.c:173 br_nf_hook_thresh+0x2a3/0x330 net/bridge/br_netfilter_hooks.c:1014 br_nf_pre_routing_finish_ipv6+0x6e3/0xd40 net/bridge/br_netfilter_ipv6.c:210 NF_HOOK include/linux/netfilter.h:289 [inline] br_nf_pre_routing_ipv6+0x3f4/0x860 net/bridge/br_netfilter_ipv6.c:240 br_nf_pre_routing+0xf05/0x1500 net/bridge/br_netfilter_hooks.c:494 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] NF_HOOK include/linux/netfilter.h:287 [inline] br_handle_frame+0xa60/0x13b0 net/bridge/br_input.c:306 __netif_receive_skb_core+0x929/0x3270 net/core/dev.c:4876 __netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:4952 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 process_backlog+0x241/0x700 net/core/dev.c:5849 napi_poll net/core/dev.c:6280 [inline] net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__tlb_remove_page_size+0x3a/0x470 mm/memory.c:308 Code: 89 fb e8 b9 52 d7 ff 48 8d 7b 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 a8 03 00 00 4c 8b 63 18 <31> ff 4c 89 e6 e8 1c 54 d7 ff 4d 85 e4 0f 84 db 01 00 00 e8 7e 52 RSP: 0018:ffff88804e74f738 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: ffff88804e74f9b0 RCX: ffffffff818ba0c8 RDX: 1ffff11009ce9f39 RSI: ffffffff818b32b7 RDI: ffff88804e74f9c8 RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: ffffffffffffffff R13: ffffea000243a600 R14: ffffea000243a600 R15: 00007f8f3bbb4000 __tlb_remove_page include/asm-generic/tlb.h:161 [inline] zap_pte_range mm/memory.c:1353 [inline] zap_pmd_range mm/memory.c:1463 [inline] zap_pud_range mm/memory.c:1492 [inline] zap_p4d_range mm/memory.c:1513 [inline] unmap_page_range+0x14e7/0x2c50 mm/memory.c:1534 unmap_single_vma+0x198/0x300 mm/memory.c:1579 unmap_vmas+0xa9/0x180 mm/memory.c:1609 exit_mmap+0x2b9/0x530 mm/mmap.c:3093 __mmput kernel/fork.c:1016 [inline] mmput+0x14e/0x4a0 kernel/fork.c:1037 exit_mm kernel/exit.c:549 [inline] do_exit+0xaec/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f8f3d8f9ae9 Code: Bad RIP value. RSP: 002b:00007f8f3ae4e188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000003 RBX: 00007f8f3da0d020 RCX: 00007f8f3d8f9ae9 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007f8f3d953f6d R08: 0000000000000008 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe1180b07f R14: 00007f8f3ae4e300 R15: 0000000000022000 net_ratelimit: 954 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:be:3c:22:7a:05:47, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 net_ratelimit: 13816 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:be:3c:22:7a:05:47, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:be:3c:22:7a:05:47, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P8115 rcu: (detected by 0, t=10503 jiffies, g=66149, q=501) syz-fuzzer R running task 25200 8115 8104 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3641 ___preempt_schedule+0x16/0x18 __local_bh_enable_ip+0x21a/0x270 kernel/softirq.c:196 local_bh_enable include/linux/bottom_half.h:32 [inline] ipt_do_table+0xd04/0x1820 net/ipv4/netfilter/ip_tables.c:361 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] __ip_local_out+0x435/0x800 net/ipv4/ip_output.c:114 ip_local_out+0x26/0x170 net/ipv4/ip_output.c:123 __ip_queue_xmit+0x91e/0x1c10 net/ipv4/ip_output.c:507 __tcp_transmit_skb+0x1b9c/0x3400 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_write_xmit+0x989/0x5100 net/ipv4/tcp_output.c:2391 __tcp_push_pending_frames+0xae/0x310 net/ipv4/tcp_output.c:2572 tcp_push+0x4b7/0x6b0 net/ipv4/tcp.c:745 tcp_sendmsg_locked+0x26b3/0x2f60 net/ipv4/tcp.c:1432 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1462 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xc3/0x120 net/socket.c:661 sock_write_iter+0x287/0x3c0 net/socket.c:966 call_write_iter include/linux/fs.h:1821 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x51b/0x770 fs/read_write.c:487 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4b129b Code: Bad RIP value. RSP: 002b:000000c00014b2e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004b129b RDX: 0000000000000015 RSI: 000000c00000a200 RDI: 0000000000000006 RBP: 000000c00014b338 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 000000000000011e R13: 000000c00058a000 R14: 000000000000001f R15: ffffffffffffffff syz-fuzzer R running task 25200 8115 8104 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3641 ___preempt_schedule+0x16/0x18 __local_bh_enable_ip+0x21a/0x270 kernel/softirq.c:196 local_bh_enable include/linux/bottom_half.h:32 [inline] ipt_do_table+0xd04/0x1820 net/ipv4/netfilter/ip_tables.c:361 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] __ip_local_out+0x435/0x800 net/ipv4/ip_output.c:114 ip_local_out+0x26/0x170 net/ipv4/ip_output.c:123 __ip_queue_xmit+0x91e/0x1c10 net/ipv4/ip_output.c:507 __tcp_transmit_skb+0x1b9c/0x3400 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_write_xmit+0x989/0x5100 net/ipv4/tcp_output.c:2391 __tcp_push_pending_frames+0xae/0x310 net/ipv4/tcp_output.c:2572 tcp_push+0x4b7/0x6b0 net/ipv4/tcp.c:745 tcp_sendmsg_locked+0x26b3/0x2f60 net/ipv4/tcp.c:1432 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1462 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xc3/0x120 net/socket.c:661 sock_write_iter+0x287/0x3c0 net/socket.c:966 call_write_iter include/linux/fs.h:1821 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x51b/0x770 fs/read_write.c:487 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4b129b Code: Bad RIP value. RSP: 002b:000000c00014b2e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004b129b RDX: 0000000000000015 RSI: 000000c00000a200 RDI: 0000000000000006 RBP: 000000c00014b338 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 000000000000011e R13: 000000c00058a000 R14: 000000000000001f R15: ffffffffffffffff rcu: rcu_preempt kthread starved for 417 jiffies! g66149 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: RCU grace-period kthread stack dump: rcu_preempt R running task 29208 10 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_timeout+0x4cf/0xfe0 kernel/time/timer.c:1818 rcu_gp_kthread+0xdad/0x21c0 kernel/rcu/tree.c:2202 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 attempt to access beyond end of device loop4: rw=1048577, want=46, limit=20 ---------------- Code disassembly (best guess): 0: e9 24 f4 ff ff jmpq 0xfffff429 5: 48 8b bc 24 a8 00 00 mov 0xa8(%rsp),%rdi c: 00 d: e8 f6 d7 46 00 callq 0x46d808 12: e9 f4 f3 ff ff jmpq 0xfffff40b 17: 48 8b 7c 24 18 mov 0x18(%rsp),%rdi 1c: e8 07 d9 46 00 callq 0x46d928 21: e9 c8 f3 ff ff jmpq 0xfffff3ee 26: 66 90 xchg %ax,%ax 28: 55 push %rbp 29: 53 push %rbx * 2a: 48 83 ec 08 sub $0x8,%rsp <-- trapping instruction 2e: 65 ff 05 13 53 b0 7e incl %gs:0x7eb05313(%rip) # 0x7eb05348 35: e8 2e 94 25 02 callq 0x2259468 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: c3 retq 3d: c0 2a 02 shrb $0x2,(%rdx)