syzbot

bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P17892/1:b..l P25101/1:b..l P25124/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=131573, q=935 ncpus=1)
task:syz.3.7327      state:R  running task     stack:26064 pid:25124 tgid:25123 ppid:5825   task_flags:0x40054c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6911
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7095
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 zap_pte_range mm/memory.c:1959 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x152f/0x4840 mm/memory.c:2091
 unmap_single_vma+0x153/0x240 mm/memory.c:2133
 unmap_vmas+0x295/0x590 mm/memory.c:2171
 exit_mmap+0x1ef/0xa30 mm/mmap.c:1302
 __mmput+0x12a/0x410 kernel/fork.c:1175
 mmput+0x67/0x80 kernel/fork.c:1198
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x819/0x2b60 kernel/exit.c:964
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1118
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b2c79c799
RSP: 002b:00007f2b2d6b2028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e
RAX: 00000000001fc000 RBX: 00007f2b2ca15fa0 RCX: 00007f2b2c79c799
RDX: 0000000000000003 RSI: 0000000006000000 RDI: 0000000000000000
RBP: 00007f2b2c832c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2b2ca16038 R14: 00007f2b2ca15fa0 R15: 00007ffe9671d7f8
 </TASK>
task:syz.1.7322      state:R  running task     stack:26048 pid:25101 tgid:25100 ppid:5826   task_flags:0x40054c flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6911
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7238
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:124 [inline]
RIP: 0010:lock_release+0x75/0x320 kernel/locking/lockdep.c:5881
Code: f5 0e 45 85 c0 0f 84 48 01 00 00 65 8b 05 6b 44 29 12 85 c0 0f 85 39 01 00 00 65 4c 8b 25 eb fc 28 12 41 8b bc 24 54 0b 00 00 <85> ff 0f 85 21 01 00 00 48 81 3b 40 37 14 94 0f 84 14 01 00 00 9c
RSP: 0018:ffffc900039d7160 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff8e7e74e0 RCX: ffffffff828068d8
RDX: 0000000000000000 RSI: ffffffff8c1b0620 RDI: 0000000000000000
RBP: ffffffff828068ae R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880217e5b80
R13: 000000a6e4af5ad8 R14: 0000000000000000 R15: 00000000070c02f2
 rcu_lock_release include/linux/rcupdate.h:322 [inline]
 rcu_read_unlock include/linux/rcupdate.h:881 [inline]
 page_ext_put+0x43/0xd0 mm/page_ext.c:579
 __reset_page_owner+0x7a/0x190 mm/page_owner.c:312
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 free_unref_folios+0xaea/0x1790 mm/page_alloc.c:3040
 folios_put_refs+0x53c/0x840 mm/swap.c:1002
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x5e5/0x1570 mm/shmem.c:1149
 shmem_truncate_range mm/shmem.c:1277 [inline]
 shmem_evict_inode+0x39e/0xbd0 mm/shmem.c:1407
 evict+0x3c2/0xad0 fs/inode.c:846
 iput_final fs/inode.c:1966 [inline]
 iput.part.0+0x605/0xf50 fs/inode.c:2015
 iput+0x35/0x40 fs/inode.c:1981
 dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
 __dentry_kill+0x1d0/0x600 fs/dcache.c:670
 finish_dput+0x76/0x480 fs/dcache.c:879
 dput.part.0+0x456/0x570 fs/dcache.c:928
 dput+0x1f/0x30 fs/dcache.c:920
 __fput+0x519/0xb40 fs/file_table.c:477
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x8b8/0x2b60 kernel/exit.c:976
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1118
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ffcd9c799
RSP: 002b:00007f6ffdb74028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: fffffffffffffffc RBX: 00007f6ffd015fa0 RCX: 00007f6ffcd9c799
RDX: 0000000000000017 RSI: ffffffffffff0005 RDI: 0000000000000000
RBP: 00007f6ffce32c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6ffd016038 R14: 00007f6ffd015fa0 R15: 00007ffc083f9518
 </TASK>
task:kworker/0:1     state:R  running task     stack:25928 pid:17892 tgid:17892 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient gc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6911
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7238
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__seqprop_spinlock_sequence include/linux/seqlock.h:228 [inline]
RIP: 0010:nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:343 [inline]
RIP: 0010:gc_worker+0x2bb/0x1630 net/netfilter/nf_conntrack_core.c:1548
Code: 00 00 48 c7 c7 48 71 da 90 e8 e1 cf 38 f8 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 4f 80 5c f8 58 48 85 db 0f 85 97 0f 00 00 <e8> 60 85 5c f8 8b 1d 3a de 2e 07 89 dd 31 ff 83 e5 01 89 ee e8 fc
RSP: 0018:ffffc9000583fb48 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89ab9d96
RDX: ffff88806db63d00 RSI: ffffffff89ab9da5 RDI: ffff88806db63d00
RBP: 0000000000001bc9 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000040000 R14: 0000000000000de5 R15: 0000000000001770
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: rcu_preempt kthread starved for 610 jiffies! g131573 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27736 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6911
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7008
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3412 Comm: kworker/R-bat_e Tainted: G     U  W I  L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [W]=WARN, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:lock_release+0x19e/0x320 kernel/locking/lockdep.c:5893
Code: ff 65 0f c1 05 4b 43 29 12 83 f8 01 0f 85 3d 01 00 00 9c 58 f6 c4 02 0f 85 28 01 00 00 41 f7 c6 00 02 00 00 0f 85 de 00 00 00 <48> 8b 44 24 10 65 48 2b 05 9d fb 28 12 0f 85 63 01 00 00 48 83 c4
RSP: 0018:ffffc90000006c88 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e7e74e0 RCX: ffffc90000006c94
RDX: 0000000000000004 RSI: ffffffff8de59622 RDI: ffffffff8c1b06a0
RBP: ffffffff81b7b2fe R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000017373 R12: ffff888035999e80
R13: ffffc90000006d40 R14: 0000000000000202 R15: 0000000000000005
FS:  0000000000000000(0000) GS:ffff88812434a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcc4ea00000 CR3: 0000000037166000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 rcu_lock_release include/linux/rcupdate.h:322 [inline]
 rcu_read_unlock include/linux/rcupdate.h:881 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
 unwind_next_frame+0x3c3/0x1ea0 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4538 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4873
 skb_ext_maybe_cow net/core/skbuff.c:7092 [inline]
 skb_ext_add+0xfa/0x810 net/core/skbuff.c:7167
 nf_bridge_unshare net/bridge/br_netfilter_hooks.c:169 [inline]
 br_nf_forward_ip.part.0+0x28/0x820 net/bridge/br_netfilter_hooks.c:681
 br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline]
 br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
 nf_hook include/linux/netfilter.h:273 [inline]
 NF_HOOK include/linux/netfilter.h:316 [inline]
 __br_forward+0x2f6/0x970 net/bridge/br_forward.c:115
 deliver_clone net/bridge/br_forward.c:131 [inline]
 maybe_deliver+0xf0/0x180 net/bridge/br_forward.c:191
 br_flood+0x193/0x650 net/bridge/br_forward.c:238
 br_handle_frame_finish+0xff4/0x1f60 net/bridge/br_input.c:229
 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x90d/0x1550 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0x6c5/0x3550 net/core/dev.c:6051
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6162
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6277
 process_backlog+0x37a/0x1580 net/core/dev.c:6628
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7692
 napi_poll net/core/dev.c:7755 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7912
 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 batadv_tt_local_purge+0x21c/0x3d0 net/batman-adv/translation-table.c:1315
 batadv_tt_purge+0x8b/0xbd0 net/batman-adv/translation-table.c:3509
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 rescuer_thread+0x905/0x14a0 kernel/workqueue.c:3583
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 6742 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
net_ratelimit: 8412 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:16:d5:54:19:6e:bb, vlan:0)