bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P13889/1:b..l rcu: (detected by 0, t=10502 jiffies, g=76753, q=908 ncpus=2) task:syz.2.2024 state:R running task stack:26056 pid:13889 tgid:13888 ppid:5843 task_flags:0x480140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6929 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7256 irqentry_exit+0x6f/0x90 kernel/entry/common.c:211 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_release+0x2b5/0x3e0 kernel/locking/lockdep.c:5893 Code: 51 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 75 56 f7 c3 00 02 00 00 74 01 fb 65 48 8b 05 8b 9a f3 10 <48> 3b 44 24 28 0f 85 8b 00 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e RSP: 0018:ffffc900055575c8 EFLAGS: 00000206 RAX: 4bbc8e108ecc1700 RBX: 0000000000000206 RCX: 4bbc8e108ecc1700 RDX: 0000000000000003 RSI: ffffffff8d9d1546 RDI: ffffffff8bc076e0 RBP: ffff88802bc66668 R08: 0000000000000000 R09: ffffffff8260a46c R10: dffffc0000000000 R11: ffffed1005e7643d R12: 0000000000000003 R13: 0000000000000003 R14: ffffffff8e13d2e0 R15: ffff88802bc65ac0 rcu_read_unlock include/linux/rcupdate.h:899 [inline] class_rcu_destructor include/linux/rcupdate.h:1195 [inline] kernfs_root+0x1ea/0x230 fs/kernfs/kernfs-internal.h:80 kernfs_root_is_locked fs/kernfs/kernfs-internal.h:109 [inline] kernfs_parent+0x51/0x190 fs/kernfs/kernfs-internal.h:133 kernfs_unlink_sibling+0x5a/0x180 fs/kernfs/dir.c:423 __kernfs_remove+0x353/0x570 fs/kernfs/dir.c:1514 kernfs_remove_by_name_ns+0xaf/0x130 fs/kernfs/dir.c:1717 kernfs_remove_by_name include/linux/kernfs.h:633 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0xfc/0x2c0 fs/sysfs/group.c:322 sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:346 device_remove_groups drivers/base/core.c:2843 [inline] device_remove_attrs+0x1aa/0x260 drivers/base/core.c:2973 device_del+0x509/0x8e0 drivers/base/core.c:3877 unregister_netdevice_many_notify+0x1a6b/0x1ff0 net/core/dev.c:12289 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:248 setup_net+0x2d6/0x320 net/core/net_namespace.c:461 copy_net_ns+0x34e/0x4e0 net/core/net_namespace.c:580 create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:218 ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3129 __do_sys_unshare kernel/fork.c:3200 [inline] __se_sys_unshare kernel/fork.c:3198 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3198 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb2f958eec9 RSP: 002b:00007fb2fa3e4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fb2f97e5fa0 RCX: 00007fb2f958eec9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200 RBP: 00007fb2f9611f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb2f97e6038 R14: 00007fb2f97e5fa0 R15: 00007fb2f990fa28 rcu: rcu_preempt kthread starved for 3029 jiffies! g76753 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27224 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0x165/0x360 kernel/sched/core.c:7026 schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083 rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5146 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: krxrpcd rxrpc_peer_keepalive_worker RIP: 0010:find_held_lock kernel/locking/lockdep.c:5347 [inline] RIP: 0010:__lock_release kernel/locking/lockdep.c:5535 [inline] RIP: 0010:lock_release+0xf1/0x3e0 kernel/locking/lockdep.c:5889 Code: 01 00 00 00 83 3d de 9d 00 0e 00 0f 84 96 01 00 00 41 8b 87 28 0b 00 00 85 c0 0f 84 1d 01 00 00 4c 89 6c 24 18 48 89 5c 24 08 <44> 8d 60 ff 49 8d af 30 0b 00 00 4d 63 ec 48 89 04 24 83 f8 32 0f RSP: 0018:ffffc90000a07b70 EFLAGS: 00000002 RAX: 0000000000000004 RBX: 0000000000000206 RCX: b2c8e36d33704700 RDX: ffffc90000a07c01 RSI: ffffffff8d7fc6fb RDI: ffffffff8bc076e0 RBP: dffffc0000000000 R08: ffffc9000f13fa50 R09: 0000000000000000 R10: ffffc90000a07cf8 R11: fffff52000140fa1 R12: ffffc9000f13fa60 R13: ffffffff8173cd25 R14: ffffffff8e13d2e0 R15: ffff888033c1bc80 FS: 0000000000000000(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555802975c8 CR3: 000000006e690000 CR4: 00000000003526f0 Call Trace: rcu_lock_release include/linux/rcupdate.h:341 [inline] rcu_read_unlock include/linux/rcupdate.h:897 [inline] class_rcu_destructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0x19a9/0x2390 arch/x86/kernel/unwind_orc.c:680 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 unpoison_slab_object mm/kasan/common.c:342 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:368 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4955 [inline] slab_alloc_node mm/slub.c:5265 [inline] kmem_cache_alloc_node_noprof+0x433/0x710 mm/slub.c:5317 kmalloc_reserve+0xbd/0x290 net/core/skbuff.c:579 __alloc_skb+0x142/0x2d0 net/core/skbuff.c:670 alloc_skb include/linux/skbuff.h:1383 [inline] nlmsg_new include/net/netlink.h:1055 [inline] fdb_notify+0xa6/0x160 net/bridge/br_fdb.c:188 br_fdb_update+0x4c8/0x690 net/bridge/br_fdb.c:1036 br_handle_frame_finish+0x587/0x1c50 net/bridge/br_input.c:144 br_nf_hook_thresh+0x3c6/0x4a0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0x999/0xd60 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x37e/0x6b0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x982/0x14c0 net/bridge/br_input.c:442 __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966 __netif_receive_skb_one_core net/core/dev.c:6077 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6192 process_backlog+0x60e/0x14f0 net/core/dev.c:6544 __napi_poll+0xc7/0x360 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xdf0 net/core/dev.c:7784 handle_softirqs+0x286/0x870 kernel/softirq.c:622 do_softirq+0xec/0x180 kernel/softirq.c:523 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] rxrpc_peer_keepalive_dispatch net/rxrpc/peer_event.c:295 [inline] rxrpc_peer_keepalive_worker+0xb54/0xde0 net/rxrpc/peer_event.c:341 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 net_ratelimit: 18011 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) net_ratelimit: 21709 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:f6:2b:ba:41:8d:b9, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)