bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P14306/1:b..l P5806/1:b..l
rcu: 	(detected by 1, t=10503 jiffies, g=41217, q=136 ncpus=2)
task:syz-executor    state:R  running task     stack:22448 pid:5806  tgid:5806  ppid:5804   task_flags:0x400100 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7087
 irqentry_exit+0x36/0x90 kernel/entry/common.c:354
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:stack_trace_consume_entry+0x0/0x170 kernel/stacktrace.c:83
Code: 75 0a e8 53 45 14 00 e9 35 ff ff ff 49 c7 c4 ea ff ff ff eb c7 e8 40 d2 b1 09 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 55 53 48 89 fb 48 83 c7
RSP: 0018:ffffc9000402f978 EFLAGS: 00000282
RAX: ffffffff82266ef2 RBX: ffffc9000402f980 RCX: 0000000000000000
RDX: 1ffff92000805f39 RSI: ffffffff82266ef2 RDI: ffffc9000402fa40
RBP: ffffc9000402fa10 R08: ffffc9000402f9b4 R09: ffffffff90fab17e
R10: ffffc9000402f980 R11: 000000000000a5b1 R12: ffffffff81a5adc0
R13: ffffc9000402fa40 R14: 0000000000000000 R15: ffff88807dbb4880
 arch_stack_walk+0x86/0x100 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 save_stack+0x162/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x8d/0x400 mm/page_owner.c:297
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:385
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4294 [inline]
 __kmalloc_noprof+0x21c/0x510 mm/slub.c:4306
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kmalloc_array_noprof include/linux/slab.h:946 [inline]
 alloc_pipe_info+0x1ec/0x590 fs/pipe.c:812
 get_pipe_inode fs/pipe.c:887 [inline]
 create_pipe_files+0x8c/0x930 fs/pipe.c:919
 __do_pipe_flags fs/pipe.c:976 [inline]
 do_pipe2+0xb0/0x1d0 fs/pipe.c:1027
 __do_sys_pipe2 fs/pipe.c:1045 [inline]
 __se_sys_pipe2 fs/pipe.c:1043 [inline]
 __x64_sys_pipe2+0x54/0x80 fs/pipe.c:1043
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f566158be89
RSP: 002b:00007ffedbb870d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000125
RAX: ffffffffffffffda RBX: 0000555557691c40 RCX: 00007f566158be89
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 00007ffedbb870e8
RBP: 00007ffedbb874a0 R08: 0000000000000007 R09: 0000555557694f10
R10: d8c23044202e8a7b R11: 0000000000000246 R12: 00005555576956d0
R13: 0000555557696430 R14: 00007ffedbb87220 R15: 0000555557690518
 </TASK>
task:syz.5.1609      state:R  running task     stack:26216 pid:14306 tgid:14302 ppid:12089  task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6944
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 unwind_next_frame+0x1776/0x20c0 arch/x86/kernel/unwind_orc.c:672
 arch_stack_walk+0x95/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 save_stack+0x162/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x8d/0x400 mm/page_owner.c:297
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:385
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4294 [inline]
 __kmalloc_node_noprof+0x21f/0x510 mm/slub.c:4300
 kmalloc_node_noprof include/linux/slab.h:928 [inline]
 __vmalloc_area_node mm/vmalloc.c:3647 [inline]
 __vmalloc_node_range_noprof+0x3d8/0x1530 mm/vmalloc.c:3846
 __vmalloc_node_noprof mm/vmalloc.c:3911 [inline]
 vmalloc_noprof+0x6b/0x90 mm/vmalloc.c:3944
 htable_create net/netfilter/xt_hashlimit.c:298 [inline]
 hashlimit_mt_check_common+0x8b0/0x1450 net/netfilter/xt_hashlimit.c:902
 hashlimit_mt_check_v1+0x2fe/0x370 net/netfilter/xt_hashlimit.c:928
 xt_check_match+0x284/0xa50 net/netfilter/x_tables.c:523
 check_match net/ipv6/netfilter/ip6_tables.c:488 [inline]
 find_check_match net/ipv6/netfilter/ip6_tables.c:505 [inline]
 find_check_entry.constprop.0+0x34d/0xa20 net/ipv6/netfilter/ip6_tables.c:556
 translate_table+0xd06/0x17b0 net/ipv6/netfilter/ip6_tables.c:733
 do_replace net/ipv6/netfilter/ip6_tables.c:1154 [inline]
 do_ip6t_set_ctl+0x926/0xbf0 net/ipv6/netfilter/ip6_tables.c:1644
 nf_setsockopt+0x8a/0xf0 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:998
 sctp_setsockopt+0x16a/0xb810 net/sctp/socket.c:4587
 do_sock_setsockopt+0x222/0x480 net/socket.c:2303
 __sys_setsockopt+0x1a0/0x230 net/socket.c:2328
 __do_sys_setsockopt net/socket.c:2334 [inline]
 __se_sys_setsockopt net/socket.c:2331 [inline]
 __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2331
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0db078d169
RSP: 002b:00007f0db15e5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007f0db09a6080 RCX: 00007f0db078d169
RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005
RBP: 00007f0db080e2a0 R08: 0000000000000488 R09: 0000000000000000
R10: 0000200000000b00 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f0db09a6080 R15: 00007fff0650fd98
 </TASK>
rcu: rcu_preempt kthread starved for 2999 jiffies! g41217 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27696 pid:18    tgid:18    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6857
 schedule_timeout+0x124/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2024
 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2226
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.14.0-rc7-syzkaller-00137-g5fc319360819 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:unwind_next_frame+0x132/0x20c0 arch/x86/kernel/unwind_orc.c:494
Code: 03 0f 85 71 02 00 00 4d 8d 75 35 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 0f b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 <84> c0 0f 85 4e 09 00 00 48 89 e9 41 0f b6 45 35 48 ba 00 00 00 00
RSP: 0018:ffffc90000a27858 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 1ffffffff3518314
RDX: 0000000000000005 RSI: ffffffff816674f2 RDI: 0000000000000001
RBP: ffffc90000a27910 R08: ffffc90000a278fc R09: ffffffff90f8792e
R10: ffffc90000a278c8 R11: 000000000000908a R12: ffffc90000a27918
R13: ffffc90000a278c8 R14: ffffc90000a278fd R15: ffff88801d698000
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555693725c8 CR3: 000000004ca02000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 arch_stack_walk+0x95/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kmem_cache_free+0x2e2/0x4d0 mm/slub.c:4711
 __skb_ext_put+0x102/0x2c0 net/core/skbuff.c:7011
 __skb_ext_del+0xf3/0x340 net/core/skbuff.c:6978
 skb_ext_del include/linux/skbuff.h:4911 [inline]
 nf_bridge_info_free net/bridge/br_netfilter_hooks.c:156 [inline]
 br_nf_dev_queue_xmit+0x7a3/0x2c50 net/bridge/br_netfilter_hooks.c:922
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 br_nf_post_routing+0x8ee/0x11b0 net/bridge/br_netfilter_hooks.c:969
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626
 nf_hook+0x474/0x7d0 include/linux/netfilter.h:269
 NF_HOOK include/linux/netfilter.h:312 [inline]
 br_forward_finish+0xcd/0x130 net/bridge/br_forward.c:66
 br_nf_hook_thresh+0x303/0x410 net/bridge/br_netfilter_hooks.c:1170
 br_nf_forward_finish+0x66a/0xba0 net/bridge/br_netfilter_hooks.c:665
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 br_nf_forward_ip.part.0+0x610/0x820 net/bridge/br_netfilter_hooks.c:719
 br_nf_forward_ip net/bridge/br_netfilter_hooks.c:679 [inline]
 br_nf_forward+0xf11/0x1bd0 net/bridge/br_netfilter_hooks.c:776
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626
 nf_hook+0x474/0x7d0 include/linux/netfilter.h:269
 NF_HOOK include/linux/netfilter.h:312 [inline]
 __br_forward+0x1be/0x5b0 net/bridge/br_forward.c:115
 deliver_clone+0x5b/0xa0 net/bridge/br_forward.c:131
 br_flood+0x491/0x5e0 net/bridge/br_forward.c:249
 br_handle_frame_finish+0xea2/0x1c90 net/bridge/br_input.c:220
 br_nf_hook_thresh+0x303/0x410 net/bridge/br_netfilter_hooks.c:1170
 br_nf_pre_routing_finish_ipv6+0x76a/0xfb0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:314 [inline]
 br_nf_pre_routing_ipv6+0x3ce/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:282 [inline]
 br_handle_frame+0xad7/0x14a0 net/bridge/br_input.c:433
 __netif_receive_skb_core.constprop.0+0xa20/0x4330 net/core/dev.c:5790
 __netif_receive_skb_one_core+0xb1/0x1e0 net/core/dev.c:5894
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6009
 process_backlog+0x443/0x15f0 net/core/dev.c:6357
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:7191
 napi_poll net/core/dev.c:7260 [inline]
 net_rx_action+0xa94/0x1010 net/core/dev.c:7382
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline]
RIP: 0010:acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:112
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 65 48 8b 05 08 28 ac 74 48 8b 00 a8 08 75 0c 66 90 0f 00 2d f8 0b 87 00 fb f4 <fa> c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900001b7d58 EFLAGS: 00000246
RAX: 0000000000004000 RBX: 0000000000000001 RCX: ffffffff8b579469
RDX: 0000000000000001 RSI: ffff888143ec5000 RDI: ffff888143ec5064
RBP: ffff888143ec5064 R08: 0000000000000001 R09: ffffed10170e6f85
R10: ffff8880b8737c2b R11: 0000000000000000 R12: ffff888020712800
R13: ffffffff8ee2eba0 R14: 0000000000000001 R15: 0000000000000000
 acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:699
 cpuidle_enter_state+0xaa/0x4f0 drivers/cpuidle/cpuidle.c:268
 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:389
 cpuidle_idle_call kernel/sched/idle.c:230 [inline]
 do_idle+0x310/0x3f0 kernel/sched/idle.c:325
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
 start_secondary+0x222/0x2b0 arch/x86/kernel/smpboot.c:315
 common_startup_64+0x13e/0x148
 </TASK>
bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
net_ratelimit: 87858 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:26:64:00:c3:1f:77, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)