bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P22197/1:b..l P22188/1:b..l
rcu: (detected by 1, t=10503 jiffies, g=213549, q=1614 ncpus=2)
task:syz.4.13619 state:R running task stack:27224 pid:22188 tgid:22181 ppid:15866 task_flags:0x400040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
preempt_schedule_notrace+0x57/0x90 kernel/sched/core.c:7502
preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
rcu_is_watching+0x7f/0xb0 kernel/rcu/tree.c:753
trace_lock_acquire include/trace/events/lock.h:23 [inline]
lock_acquire+0x5f/0x350 kernel/locking/lockdep.c:5831
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:840 [inline]
get_obj_cgroup_from_memcg mm/memcontrol.c:2903 [inline]
charge_memcg+0x3d/0x2b0 mm/memcontrol.c:5021
__mem_cgroup_charge+0x25/0x80 mm/memcontrol.c:5041
mem_cgroup_charge include/linux/memcontrol.h:644 [inline]
shmem_alloc_and_add_folio+0x7bc/0xf60 mm/shmem.c:1983
shmem_get_folio_gfp+0x5b2/0x16c0 mm/shmem.c:2562
shmem_get_folio mm/shmem.c:2668 [inline]
shmem_write_begin+0x16c/0x330 mm/shmem.c:3302
generic_perform_write+0x2d5/0x8f0 mm/filemap.c:4336
shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3477
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffb3899ce59
RSP: 002b:00007ffb398fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ffb38c15fa0 RCX: 00007ffb3899ce59
RDX: 00000000ffffff6a RSI: 0000200000000000 RDI: 0000000000000004
RBP: 00007ffb38a32e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffb38c16038 R14: 00007ffb38c15fa0 R15: 00007fff22637258
task:syz.4.13619 state:R running task stack:22576 pid:22197 tgid:22181 ppid:15866 task_flags:0x400140 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7409
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
__local_bh_enable_ip+0xe1/0x130 kernel/softirq.c:457
spin_unlock_bh include/linux/spinlock.h:396 [inline]
__fib6_clean_all+0x44a/0x580 net/ipv6/ip6_fib.c:2324
rt6_mtu_change+0xd9/0x130 net/ipv6/route.c:5105
addrconf_notify+0x548/0x1050 net/ipv6/addrconf.c:3693
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_mtu net/core/dev.c:2325 [inline]
netif_set_mtu_ext+0x5ac/0x830 net/core/dev.c:9891
do_setlink+0xa81/0x4670 net/core/rtnetlink.c:3178
rtnl_group_changelink net/core/rtnetlink.c:3863 [inline]
__rtnl_newlink net/core/rtnetlink.c:4031 [inline]
rtnl_newlink+0x148e/0x1bd0 net/core/rtnetlink.c:4159
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec net/socket.c:775 [inline]
__sock_sendmsg net/socket.c:790 [inline]
____sys_sendmsg+0x9b9/0xa20 net/socket.c:2684
___sys_sendmsg+0x2a5/0x360 net/socket.c:2738
__sys_sendmsg net/socket.c:2770 [inline]
__do_sys_sendmsg net/socket.c:2775 [inline]
__se_sys_sendmsg net/socket.c:2773 [inline]
__x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2773
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffb3899ce59
RSP: 002b:00007ffb398bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffb38c16180 RCX: 00007ffb3899ce59
RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000010
RBP: 00007ffb38a32e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffb38c16218 R14: 00007ffb38c16180 R15: 00007fff22637258
rcu: rcu_preempt kthread starved for 8697 jiffies! g213549 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28040 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5504 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7228
__schedule_loop kernel/sched/core.c:7307 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7322
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32750 Comm: kworker/R-bond6 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: 0x0 (bond6)
RIP: 0010:ip6_ignore_linkdown+0xa1/0x140 include/net/addrconf.h:457
Code: 8e 6f f7 48 85 db 0f 84 8a 00 00 00 e8 78 8e 6f f7 48 81 c3 50 06 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 30 84 c0 75 77 8b 1b <31> ff 89 de e8 96 92 6f f7 85 db 0f 95 c0 5b 41 5e 5d e9 c8 6c 54
RSP: 0018:ffffc90000006658 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888026768000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffc90000006980 R09: ffffc90000006990
R10: ffffc900000067e0 R11: fffff52000000cfe R12: 0000000000000003
R13: ffff88801f2e20c8 R14: dffffc0000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0f99fa56d0 CR3: 000000007ceec000 CR4: 00000000003526f0
Call Trace:
find_match+0x9c/0xb40 net/ipv6/route.c:783
__find_rr_leaf+0x243/0x740 net/ipv6/route.c:872
find_rr_leaf net/ipv6/route.c:893 [inline]
rt6_select net/ipv6/route.c:937 [inline]
fib6_table_lookup+0x3c6/0xae0 net/ipv6/route.c:2255
ip6_pol_route+0x229/0x14d0 net/ipv6/route.c:2292
pol_lookup_func include/net/ip6_fib.h:669 [inline]
__fib6_rule_action net/ipv6/fib6_rules.c:240 [inline]
fib6_rule_action+0x9d7/0xc00 net/ipv6/fib6_rules.c:278
fib_rules_lookup+0x770/0xeb0 net/core/fib_rules.c:340
fib6_rule_lookup+0x1a0/0x730 net/ipv6/fib6_rules.c:115
ip6_route_input_lookup net/ipv6/route.c:2363 [inline]
ip6_route_input+0x78d/0xb20 net/ipv6/route.c:2666
ip6_rcv_finish+0x141/0x280 net/ipv6/ip6_input.c:117
ip_sabotage_in+0x1e1/0x270 net/bridge/br_netfilter_hooks.c:988
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316
__netif_receive_skb_one_core net/core/dev.c:6206 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
netif_receive_skb_internal net/core/dev.c:6405 [inline]
netif_receive_skb+0x278/0xbf0 net/core/dev.c:6464
NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:318
br_handle_frame_finish+0x1192/0x1990 net/bridge/br_input.c:-1
br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1
br_nf_pre_routing_finish_ipv6+0x90c/0xc40 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x382/0x6f0 net/bridge/br_netfilter_ipv6.c:183
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0x127f/0x1510 net/bridge/br_input.c:442
__netif_receive_skb_core+0x989/0x30b0 net/core/dev.c:6093
__netif_receive_skb_one_core net/core/dev.c:6204 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
process_backlog+0x706/0x1860 net/core/dev.c:6670
__napi_poll+0xaa/0x330 net/core/dev.c:7729
napi_poll net/core/dev.c:7792 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:7949
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:206
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 ba 64 f7 f5 48 89 df e8 12 da f7 f5 e8 8d 96 23 f6 fb bf 01 00 00 00 72 f1 e8 f5 65 8b 05 bb b3 8f 07 85 c0 74 07 5b c3 cc cc cc cc
RSP: 0018:ffffc9000d69fce0 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88801aea3000 RCX: 0000000080000002
RDX: 0000000000000000 RSI: ffffffff8c291100 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff903117f7 R09: 1ffffffff20622fe
R10: dffffc0000000000 R11: fffffbfff20622ff R12: ffff88803771b4b0
R13: ffff8880357cd230 R14: ffff88802a6b3b60 R15: ffff8880541a9230
rescuer_thread+0xb78/0x10b0 kernel/workqueue.c:3647
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 18443 callbacks suppressed
bridge0: received packet on veth1_to_bridge with own address as source address (addr:72:76:86:24:86:37, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
net_ratelimit: 16401 callbacks suppressed
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:72:76:86:24:86:37, vlan:1)