syzbot

bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P5513/1:b..l P10138/1:b..l P49/1:b..l P1027/1:b..l P10132/1:b..l P5218/1:b..l P3567/1:b..l P3530/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=39633, q=371 ncpus=2)
task:kworker/u8:8    state:R  running task     stack:23176 pid:3530  tgid:3530  ppid:2      task_flags:0x4248060 flags:0x00004000
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_release+0x183/0x2f0 kernel/locking/lockdep.c:5896
Code: 0f c1 05 c8 53 37 12 83 f8 01 0f 85 1d 01 00 00 9c 58 f6 c4 02 0f 85 08 01 00 00 41 f7 c5 00 02 00 00 74 01 fb 48 8b 44 24 10 <65> 48 2b 05 dd 11 37 12 0f 85 58 01 00 00 48 83 c4 18 5b 41 5c 41
RSP: 0018:ffffc9000b536d08 EFLAGS: 00000206
RAX: f76b8d3fe0235b00 RBX: ffffffff8e5c4c80 RCX: ffffc9000b536d14
RDX: 0000000000000005 RSI: ffffffff8de0448a RDI: ffffffff8c155ce0
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000001414f R12: ffffffff816a9ac4
R13: 0000000000000206 R14: ffff8880324f8000 R15: 0000000000000006
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:871 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0x3f9/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x84/0x1a0 mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4204
 ext4_init_io_end+0x24/0x170 fs/ext4/page-io.c:307
 ext4_do_writepages+0x985/0x3490 fs/ext4/inode.c:2811
 ext4_writepages+0x37a/0x7d0 fs/ext4/inode.c:2953
 do_writepages+0x27a/0x600 mm/page-writeback.c:2636
 __writeback_single_inode+0x160/0xfb0 fs/fs-writeback.c:1680
 writeback_sb_inodes+0x601/0xf90 fs/fs-writeback.c:1976
 __writeback_inodes_wb+0xf8/0x2d0 fs/fs-writeback.c:2047
 wb_writeback+0x7f3/0xb70 fs/fs-writeback.c:2158
 wb_check_old_data_flush fs/fs-writeback.c:2262 [inline]
 wb_do_writeback fs/fs-writeback.c:2315 [inline]
 wb_workfn+0x8ca/0xbe0 fs/fs-writeback.c:2343
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:9    state:R  running task     stack:23512 pid:3567  tgid:3567  ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0xc25/0x20a0 arch/x86/kernel/unwind_orc.c:641
Code: 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 48 11 00 00 4c 89 c0 49 c7 45 58 00 00 00 00 <48> ba 00 00 00 00 00 fc ff df 48 c1 e8 03 0f b6 34 10 49 8d 40 01
RSP: 0018:ffffc9000bcb76f8 EFLAGS: 00000246
RAX: ffffffff914bc070 RBX: 0000000000000001 RCX: ffffffff914bc06c
RDX: 1ffff92001796ef8 RSI: 1ffff92001796ef6 RDI: ffffc9000bcb77c0
RBP: ffffc9000bcb77b0 R08: ffffffff914bc070 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000000114e9 R12: ffffc9000bcb77b8
R13: ffffc9000bcb7768 R14: ffffc9000bcb7b60 R15: ffffc9000bcb779c
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kmem_cache_free+0x2d1/0x4d0 mm/slub.c:4745
 kfree_skbmem+0x1a4/0x1f0 net/core/skbuff.c:1110
 __kfree_skb net/core/skbuff.c:1167 [inline]
 sk_skb_reason_drop+0x136/0x1a0 net/core/skbuff.c:1204
 kfree_skb_reason include/linux/skbuff.h:1275 [inline]
 kfree_skb include/linux/skbuff.h:1284 [inline]
 ieee80211_iface_work+0x434/0x1020 net/mac80211/iface.c:1726
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:udevd           state:R  running task     stack:24872 pid:5218  tgid:5218  ppid:1      task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_notrace+0x62/0xe0 kernel/sched/core.c:7059
 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
 rcu_lockdep_current_cpu_online+0x110/0x150 kernel/rcu/tree.c:4008
 rcu_read_lock_held_common kernel/rcu/update.c:113 [inline]
 rcu_read_lock_held+0x27/0x50 kernel/rcu/update.c:349
 lookup_page_ext+0x10d/0x1d0 mm/page_ext.c:254
 page_ext_iter_begin include/linux/page_ext.h:132 [inline]
 __page_table_check_zero+0x1a4/0x5d0 mm/page_table_check.c:139
 page_table_check_free include/linux/page_table_check.h:43 [inline]
 free_pages_prepare mm/page_alloc.c:1249 [inline]
 __free_frozen_pages+0x7df/0x1180 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4204
 getname_flags.part.0+0x4c/0x550 fs/namei.c:146
 getname_flags+0x93/0xf0 include/linux/audit.h:322
 getname include/linux/fs.h:2907 [inline]
 getname_maybe_null include/linux/fs.h:2914 [inline]
 getname_maybe_null include/linux/fs.h:2911 [inline]
 vfs_fstatat+0xe1/0xf0 fs/stat.c:370
 __do_sys_newfstatat+0x97/0x120 fs/stat.c:542
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe8ca711b0a
RSP: 002b:00007ffe13ea1c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 000055b9ef865408 RCX: 00007fe8ca711b0a
RDX: 00007ffe13ea1c70 RSI: 000055b9ef853ef3 RDI: 00000000ffffff9c
RBP: 000055ba1fbed168 R08: 00063489548db180 R09: 00007fe8cae84000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe13ea1c70 R14: 0000000000000000 R15: 00063489548db180
 </TASK>
task:kworker/u8:4    state:R  running task     stack:25608 pid:10132 tgid:10132 ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_release+0x183/0x2f0 kernel/locking/lockdep.c:5896
Code: 0f c1 05 c8 53 37 12 83 f8 01 0f 85 1d 01 00 00 9c 58 f6 c4 02 0f 85 08 01 00 00 41 f7 c5 00 02 00 00 74 01 fb 48 8b 44 24 10 <65> 48 2b 05 dd 11 37 12 0f 85 58 01 00 00 48 83 c4 18 5b 41 5c 41
RSP: 0018:ffffc900042a7480 EFLAGS: 00000206
RAX: 1b11b65291901d00 RBX: ffffffff8e5c4c80 RCX: ffffc900042a748c
RDX: 0000000000000003 RSI: ffffffff8de0448a RDI: ffffffff8c155ce0
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000000061ac R12: ffffffff816a9ac4
R13: 0000000000000206 R14: ffff88807b46bc00 R15: 0000000000000004
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:871 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0x3f9/0x20a0 arch/x86/kernel/unwind_orc.c:479
 __unwind_start+0x45f/0x7f0 arch/x86/kernel/unwind_orc.c:758
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0x73/0x100 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4842
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1574 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1a92/0x2fd0 net/mac80211/ibss.c:1600
 ieee80211_iface_process_skb net/mac80211/iface.c:1670 [inline]
 ieee80211_iface_work+0xbf4/0x1020 net/mac80211/iface.c:1724
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:5    state:R  running task     stack:24904 pid:1027  tgid:1027  ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x41/0x70 kernel/kcov.c:217
Code: a9 00 01 ff 00 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 3c 16 00 00 85 c0 74 2b 8b 82 18 16 00 00 <83> f8 02 75 20 48 8b 8a 20 16 00 00 8b 92 1c 16 00 00 48 8b 01 48
RSP: 0018:ffffc900038ef948 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888063330000 RCX: ffffffff8af71501
RDX: ffff8880271b5a00 RSI: ffffffff8af1e565 RDI: ffff88805ce34d80
RBP: ffff88805919dd9a R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88805ce34d80
R13: 0000000000000000 R14: ffff88805919dd90 R15: ffff88805ce34d80
 sta_info_get+0x15/0x340 net/mac80211/sta_info.c:206
 ieee80211_update_sta_info net/mac80211/ibss.c:979 [inline]
 ieee80211_rx_bss_info net/mac80211/ibss.c:1092 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline]
 ieee80211_ibss_rx_queued_mgmt+0xffc/0x2fd0 net/mac80211/ibss.c:1600
 ieee80211_iface_process_skb net/mac80211/iface.c:1670 [inline]
 ieee80211_iface_work+0xbf4/0x1020 net/mac80211/iface.c:1724
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:3    state:R  running task     stack:24376 pid:49    tgid:49    ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__orc_find+0x92/0xf0 arch/x86/kernel/unwind_orc.c:99
Code: 48 c1 ea 03 0f b6 34 0a 48 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13 48 01 da 49 39 d5 73 af 4c 8d 63 fc <49> 39 ec 73 b2 4d 29 f7 49 c1 ff 02 4b 8d 14 7f 48 8d 04 50 48 83
RSP: 0018:ffffc90000b97638 EFLAGS: 00000293
RAX: ffffffff914c8414 RBX: ffffffff90c3f8ac RCX: dffffc0000000000
RDX: ffffffff821f7959 RSI: 0000000000000000 RDI: ffffffff90c3f898
RBP: ffffffff90c3f8a8 R08: ffffffff914c847a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000011f79 R12: ffffffff90c3f8a8
R13: ffffffff821f7942 R14: ffffffff90c3f898 R15: ffffffff90c3f8a4
 orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
 unwind_next_frame+0x2ec/0x20a0 arch/x86/kernel/unwind_orc.c:494
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kmem_cache_free+0x2d1/0x4d0 mm/slub.c:4745
 skb_kfree_head net/core/skbuff.c:1046 [inline]
 skb_kfree_head net/core/skbuff.c:1043 [inline]
 skb_free_head+0x1b7/0x210 net/core/skbuff.c:1060
 skb_release_data+0x776/0x9c0 net/core/skbuff.c:1087
 skb_release_all net/core/skbuff.c:1152 [inline]
 __kfree_skb net/core/skbuff.c:1166 [inline]
 sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1204
 kfree_skb_reason include/linux/skbuff.h:1275 [inline]
 kfree_skb include/linux/skbuff.h:1284 [inline]
 ieee80211_iface_work+0x434/0x1020 net/mac80211/iface.c:1726
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz-executor    state:R  running task     stack:25512 pid:10138 tgid:10138 ppid:5835   task_flags:0x400100 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_release+0x183/0x2f0 kernel/locking/lockdep.c:5896
Code: 0f c1 05 c8 53 37 12 83 f8 01 0f 85 1d 01 00 00 9c 58 f6 c4 02 0f 85 08 01 00 00 41 f7 c5 00 02 00 00 74 01 fb 48 8b 44 24 10 <65> 48 2b 05 dd 11 37 12 0f 85 58 01 00 00 48 83 c4 18 5b 41 5c 41
RSP: 0018:ffffc9000417f718 EFLAGS: 00000206
RAX: 344751523fc37500 RBX: ffffffff8e5c4c80 RCX: ffffc9000417f724
RDX: 0000000000000004 RSI: ffffffff8de0448a RDI: ffffffff8c155ce0
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8229bf06
R13: 0000000000000206 R14: ffff88802e4d0000 R15: 0000000000000005
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:871 [inline]
 __update_page_owner_free_handle.constprop.0+0x31b/0x4a0 mm/page_owner.c:283
 __reset_page_owner+0x93/0x1a0 mm/page_owner.c:309
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4204
 vm_area_dup+0x27/0x8d0 mm/vma_init.c:122
 dup_mmap+0x877/0x21d0 mm/mmap.c:1784
 dup_mm kernel/fork.c:1477 [inline]
 copy_mm kernel/fork.c:1529 [inline]
 copy_process+0x4081/0x7650 kernel/fork.c:2169
 kernel_clone+0xfc/0x960 kernel/fork.c:2599
 __do_sys_clone+0xce/0x120 kernel/fork.c:2742
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f507c985213
RSP: 002b:00007ffdd0ee8808 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f507c985213
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 000055557cf4e7d0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000
 </TASK>
task:dhcpcd          state:R  running task     stack:22632 pid:5513  tgid:5513  ppid:5512   task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0xe66/0x20a0 arch/x86/kernel/unwind_orc.c:664
Code: 85 0f 0d 00 00 49 89 6d 40 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e c6 0c 00 00 <41> 39 5d 00 0f 84 91 07 00 00 bd 01 00 00 00 e9 5f f5 ff ff ba 28
RSP: 0018:ffffc90003b1f170 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffc90003b20000
RDX: 1ffff92000763e3c RSI: ffffc90003b1f8b8 RDI: ffffc90003b1f220
RBP: ffffc90003b1f990 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000008528c R12: ffffc90003b1f230
R13: ffffc90003b1f1e0 R14: ffffc90003b1f8e8 R15: ffffc90003b1f214
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x84/0x1a0 mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:385
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4328 [inline]
 __kmalloc_node_track_caller_noprof+0x221/0x510 mm/slub.c:4347
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:601
 __alloc_skb+0x166/0x380 net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1336 [inline]
 alloc_skb_with_frags+0xe0/0x860 net/core/skbuff.c:6665
 sock_alloc_send_pskb+0x7fb/0x990 net/core/sock.c:2999
 unix_dgram_sendmsg+0x3e9/0x17a0 net/unix/af_unix.c:2083
 unix_seqpacket_sendmsg+0x12a/0x1c0 net/unix/af_unix.c:2469
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 sock_write_iter+0x4ff/0x5b0 net/socket.c:1131
 do_iter_readv_writev+0x654/0x950 fs/read_write.c:827
 vfs_writev+0x35f/0xde0 fs/read_write.c:1057
 do_writev+0x28c/0x340 fs/read_write.c:1103
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f703478b407
RSP: 002b:00007ffd33067930 EFLAGS: 00000202 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f7034701740 RCX: 00007f703478b407
RDX: 0000000000000005 RSI: 00007ffd33067990 RDI: 0000000000000018
RBP: 0000561b739ba320 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd33087db0
R13: 0000000000000004 R14: 0000000000000148 R15: 00007ffd33077b80
 </TASK>
task:syz.1.125       state:R  running task     stack:27672 pid:6670  tgid:6670  ppid:5845   task_flags:0x40044c flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5875
Code: 0c 37 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 b2 44 11 0f 0f 82 74 02 00 00 8b 35 7a 76 11 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 49 0c 37 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc9000458f630 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e5c4c80 RCX: 00000000ef9d33e4
RDX: 0000000000000000 RSI: ffffffff8de0448a RDI: ffffffff8c155ce0
RBP: 0000000000000002 R08: 0ac0d5affe09d4ff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x84/0x1a0 mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 vfree+0x1fd/0xb50 mm/vmalloc.c:3434
 kcov_put kernel/kcov.c:439 [inline]
 kcov_put kernel/kcov.c:435 [inline]
 kcov_close+0x34/0x60 kernel/kcov.c:535
 __fput+0x402/0xb70 fs/file_table.c:465
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x86c/0x2bd0 kernel/exit.c:964
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1105
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x790 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:111
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x490 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2aca3c1265
RSP: 002b:00007f2acb205f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00007f2aca5b6240 RCX: 00007f2aca3c1265
RDX: 00007f2acb205fc0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f2aca410d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f2aca5b6240 R15: 00007ffc9aed7a88
 </TASK>
task:klogd           state:R  running task     stack:25512 pid:5207  tgid:5207  ppid:1      task_flags:0x400100 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6966
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
 sock_def_readable+0x15b/0x600 net/core/sock.c:3583
 unix_dgram_sendmsg+0xc97/0x17a0 net/unix/af_unix.c:2236
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 __sys_sendto+0x4a3/0x520 net/socket.c:2180
 __do_sys_sendto net/socket.c:2187 [inline]
 __se_sys_sendto net/socket.c:2183 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2183
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd951b0c407
RSP: 002b:00007fffcd2f9760 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fd9519bcc80 RCX: 00007fd951b0c407
RDX: 000000000000005b RSI: 00007fffcd2f98a0 RDI: 0000000000000003
RBP: 00007fffcd2f9cd0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007fffcd2f9ce8
R13: 00007fffcd2f98a0 R14: 0000000000000040 R15: 00007fffcd2f98a0
 </TASK>
task:kworker/u8:1    state:R  running task     stack:24072 pid:13    tgid:13    ppid:2      task_flags:0x4208160 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0x160f/0x20a0 arch/x86/kernel/unwind_orc.c:665
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 4a f8 ff ff e8 d4 03 b5 00 e9 40 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8b 14 24 <48> c1 ea 03 80 3c 02 00 0f 85 5b 05 00 00 49 8d 7d 08 49 8b 5d 38
RSP: 0018:ffffc90000126e38 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90000128000
RDX: ffffc90000126ee0 RSI: ffffc90000127948 RDI: ffffc90000126ee8
RBP: ffffc90000127ba0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000009f3e6 R12: ffffc90000126ef8
R13: ffffc90000126ea8 R14: ffffc90000127978 R15: ffffc90000126edc
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4328 [inline]
 __kmalloc_noprof+0x223/0x510 mm/slub.c:4340
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 cfg80211_inform_single_bss_data+0x53e/0x1df0 net/wireless/scan.c:2339
 cfg80211_inform_bss_data+0x224/0x3bc0 net/wireless/scan.c:3222
 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3313
 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226
 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1905/0x2fd0 net/mac80211/ibss.c:1600
 ieee80211_iface_process_skb net/mac80211/iface.c:1670 [inline]
 ieee80211_iface_work+0xbf4/0x1020 net/mac80211/iface.c:1724
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz-executor    state:R  running task     stack:23528 pid:5835  tgid:5835  ppid:5834   task_flags:0x400100 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0xb/0x350 kernel/locking/lockdep.c:5831
Code: 68 ea 09 eb c3 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 4d 89 cf 41 56 <41> 89 f6 41 55 41 89 d5 41 54 45 89 c4 55 89 cd 53 48 89 fb 48 83
RSP: 0000:ffffc9000412f4c0 EFLAGS: 00000246
RAX: ffffffff816a978d RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e5c4c80
RBP: ffffc9000412f598 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000011f7e R12: ffffffff81a71610
R13: ffffc9000412f550 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __reset_page_owner+0x84/0x1a0 mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4204
 alloc_buffer_head+0x21/0x160 fs/buffer.c:3032
 folio_alloc_buffers+0x2b5/0x6c0 fs/buffer.c:935
 create_empty_buffers+0x36/0x480 fs/buffer.c:1697
 folio_create_buffers+0x109/0x150 fs/buffer.c:1808
 __block_write_begin_int+0x320/0x16d0 fs/buffer.c:2132
 block_page_mkwrite+0x3d3/0x4b0 fs/buffer.c:2646
 ext4_page_mkwrite+0x8d8/0x1760 fs/ext4/inode.c:6598
 do_page_mkwrite+0x171/0x380 mm/memory.c:3378
 do_shared_fault mm/memory.c:5666 [inline]
 do_fault mm/memory.c:5728 [inline]
 do_pte_missing mm/memory.c:4251 [inline]
 handle_pte_fault mm/memory.c:6069 [inline]
 __handle_mm_fault+0x3829/0x5490 mm/memory.c:6212
 handle_mm_fault+0x589/0xd10 mm/memory.c:6381
 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fefdca77e1f
RSP: 002b:00007ffd262a83a0 EFLAGS: 00010202
RAX: 00007fefdaf78000 RBX: 00005555715e5e10 RCX: 0000000000000002
RDX: 1ffffffff02a9b1a RSI: 00005555715e9c68 RDI: 0000000000000004
RBP: 00007ffd262a8690 R08: 00005555715e9ca8 R09: 0000000000001363
R10: 0000000000000001 R11: 00007ffd262a88a0 R12: 00007ffd262a86f0
R13: 0000000000000004 R14: 00007ffd262a8410 R15: 00007ffd262a84e0
 </TASK>
task:syz-executor    state:R  running task     stack:25864 pid:10139 tgid:10139 ppid:10133  task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: a6 ce 53 00 48 89 df 5b e9 fd 55 59 00 be 03 00 00 00 5b e9 62 fe 1b 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 34 24 65 48 8b 15 a8 ca 13 12 65 8b 05 b9 ca 13
RSP: 0018:ffffc900181ff718 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff88801e028a00 RCX: ffffffff8229bd3a
RDX: ffff88802e4d5a00 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 00000000045a03e1
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
 page_ext_data include/linux/page_ext.h:102 [inline]
 get_page_owner mm/page_owner.c:143 [inline]
 __update_page_owner_free_handle.constprop.0+0x158/0x4a0 mm/page_owner.c:273
 __reset_page_owner+0x93/0x1a0 mm/page_owner.c:309
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_node_track_caller_noprof+0x1d3/0x510 mm/slub.c:4347
 kmemdup_noprof+0x29/0x60 mm/util.c:137
 kmemdup_noprof include/linux/fortify-string.h:765 [inline]
 neigh_parms_alloc+0x85/0x5d0 net/core/neighbour.c:1665
 inetdev_init+0x13c/0x5a0 net/ipv4/devinet.c:280
 inetdev_event+0xc5f/0x18a0 net/ipv4/devinet.c:1591
 notifier_call_chain+0xbc/0x410 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 register_netdevice+0x182e/0x2270 net/core/dev.c:11143
 register_netdev+0x34/0x50 net/core/dev.c:11221
 vti6_init_net+0x28f/0x490 net/ipv6/ip6_vti.c:1158
 ops_init+0x1df/0x5f0 net/core/net_namespace.c:138
 setup_net+0x1ff/0x510 net/core/net_namespace.c:442
 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574
 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218
 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121
 __do_sys_unshare kernel/fork.c:3192 [inline]
 __se_sys_unshare kernel/fork.c:3190 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58d09901a7
RSP: 002b:00007ffd8489a9c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f58d0bb5f40 RCX: 00007f58d09901a7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f58d0bb6738 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000
 </TASK>
task:kworker/u8:6    state:R  running task     stack:25144 pid:1150  tgid:1150  ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7109
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: a6 ce 53 00 48 89 df 5b e9 fd 55 59 00 be 03 00 00 00 5b e9 62 fe 1b 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 34 24 65 48 8b 15 a8 ca 13 12 65 8b 05 b9 ca 13
RSP: 0018:ffffc90003a8f8f0 EFLAGS: 00000216
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffffff8b0487a3
RDX: ffff888027f41e00 RSI: 00000000000000f0 RDI: 0000000000000004
RBP: 0000000000000008 R08: 0000000000000004 R09: 00000000000000f0
R10: 000000000000003c R11: 0000000000000001 R12: 000000000000003c
R13: ffff8880284230c8 R14: 000000000000000c R15: 00000000000000f0
 ieee80211_sta_get_rates+0x27d/0x5b0 net/mac80211/util.c:1547
 ieee80211_update_sta_info net/mac80211/ibss.c:982 [inline]
 ieee80211_rx_bss_info net/mac80211/ibss.c:1092 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1053/0x2fd0 net/mac80211/ibss.c:1600
 ieee80211_iface_process_skb net/mac80211/iface.c:1670 [inline]
 ieee80211_iface_work+0xbf4/0x1020 net/mac80211/iface.c:1724
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: rcu_preempt kthread starved for 11012 jiffies! g39633 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27368 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5397 [inline]
 __schedule+0x116a/0x5de0 kernel/sched/core.c:6786
 __schedule_loop kernel/sched/core.c:6864 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6879
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xb00 kernel/rcu/tree.c:2054
 rcu_gp_kthread+0x270/0x380 kernel/rcu/tree.c:2256
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc6-syzkaller-00253-g4871b7cb27f4 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: db 70 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 87 27 00 fb f4 <e9> 8c fb 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197df8 EFLAGS: 000002c6
RAX: 000000000034c37b RBX: 0000000000000001 RCX: ffffffff8b828c69
RDX: 0000000000000000 RSI: ffffffff8de296c6 RDI: ffffffff8c155ce0
RBP: ffffed1003cd7b40 R08: 0000000000000001 R09: ffffed10170a6645
R10: ffff8880b853322b R11: 0000000000000001 R12: 0000000000000001
R13: ffff88801e6bda00 R14: ffffffff90a95850 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88812482e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561b739d55a0 CR3: 00000000260a4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:749
 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:185 [inline]
 do_idle+0x391/0x510 kernel/sched/idle.c:325
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:315
 common_startup_64+0x13e/0x148
 </TASK>
net_ratelimit: 6752 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:a2:59:b4:31:37:b6, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:a2:59:b4:31:37:b6, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:a2:59:b4:31:37:b6, vlan:0)