bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1207/2:b..l P5178/1:b..l P17949/1:b..l rcu: (detected by 0, t=10502 jiffies, g=122865, q=378572 ncpus=2) task:syz.4.2885 state:R running task stack:27672 pid:17949 tgid:17944 ppid:5815 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe6/0x5fa0 kernel/sched/core.c:6867 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7194 irqentry_exit+0x17b/0x670 kernel/entry/common.c:216 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:htab_map_update_elem_in_place+0x497/0x9e0 kernel/bpf/hashtab.c:1310 Code: ff 4d 85 e4 0f 85 7b 02 00 00 e8 44 ea dd ff 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 12 e5 dd ff 48 85 ed 0f 85 cb 03 00 00 24 ea dd ff 4d 85 ff 74 61 e8 1a ea dd ff 48 8d 7b 20 48 b8 00 RSP: 0018:ffffc9000da7f900 EFLAGS: 00000246 RAX: 0000000000080000 RBX: ffff8880362a7000 RCX: ffffc9000cf2b000 RDX: 0000000000080000 RSI: ffffffff8229179c RDI: ffff888075c3a4c0 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000200 R13: ffff8880b853bfc0 R14: ffff88804b760688 R15: 0000000000000000 bpf_percpu_hash_update+0xc1/0x240 kernel/bpf/hashtab.c:2403 bpf_map_update_value+0x967/0xff0 kernel/bpf/syscall.c:270 generic_map_update_batch+0x443/0x610 kernel/bpf/syscall.c:2038 bpf_map_do_batch+0x66f/0x6d0 kernel/bpf/syscall.c:5647 __sys_bpf+0xa12/0x5050 kernel/bpf/syscall.c:6228 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7b/0xc0 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9217d9aeb9 RSP: 002b:00007f9218bb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f9218015fa0 RCX: 00007f9217d9aeb9 RDX: 0000000000000038 RSI: 00002000000005c0 RDI: 000000000000001a RBP: 00007f9217e08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9218016038 R14: 00007f9218015fa0 R15: 00007ffca9fd4ef8 task:udevd state:R running task stack:24888 pid:5178 tgid:5178 ppid:1 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe6/0x5fa0 kernel/sched/core.c:6867 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] avc_reclaim_node security/selinux/avc.c:488 [inline] avc_alloc_node+0x3f6/0x670 security/selinux/avc.c:507 avc_insert security/selinux/avc.c:618 [inline] avc_compute_av+0x101/0x820 security/selinux/avc.c:993 avc_perm_nonode+0xb1/0x180 security/selinux/avc.c:1117 avc_has_perm_noaudit+0x2d4/0x3b0 security/selinux/avc.c:1160 selinux_inode_permission+0x81c/0x1160 security/selinux/hooks.c:3255 security_inode_permission+0xda/0x250 security/security.c:1816 lookup_inode_permission_may_exec fs/namei.c:641 [inline] may_lookup fs/namei.c:1908 [inline] link_path_walk+0x2a5/0x1cc0 fs/namei.c:2545 path_lookupat+0x74/0xc40 fs/namei.c:2753 filename_lookup+0x202/0x590 fs/namei.c:2783 vfs_statx+0xff/0x3f0 fs/stat.c:353 vfs_fstatat+0x7b/0xf0 fs/stat.c:375 __do_sys_newfstatat+0x9d/0x120 fs/stat.c:542 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff6df111b0a RSP: 002b:00007ffd4e9aa878 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 000055f1865a14c0 RCX: 00007ff6df111b0a RDX: 00007ffd4e9aa880 RSI: 000055f1865a14c0 RDI: 00000000ffffff9c RBP: 000055f186364f90 R08: 00063478c1c69200 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4e9aa880 R13: 000055f16e0c0100 R14: 0000000000000002 R15: 0000000000000000 task:kworker/1:2 state:R running task stack:22168 pid:1207 tgid:1207 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: mld mld_ifc_work Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe6/0x5fa0 kernel/sched/core.c:6867 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:457 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline] __dev_queue_xmit+0x7f1/0x46f0 net/core/dev.c:4859 dev_queue_xmit include/linux/netdevice.h:3381 [inline] neigh_resolve_output net/core/neighbour.c:1594 [inline] neigh_resolve_output+0x51f/0x8f0 net/core/neighbour.c:1574 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xb0f/0x1cd0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x10d0 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x2aa/0xa60 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK.constprop.0+0x114/0x8b0 include/linux/netfilter.h:312 mld_sendpack+0x8f7/0xec0 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x75a/0xc10 net/ipv6/mcast.c:2693 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 rcu: rcu_preempt kthread starved for 4345 jiffies! g122865 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28088 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe6/0x5fa0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x1a9/0xb00 kernel/rcu/tree.c:2083 rcu_gp_kthread+0x21e/0x320 kernel/rcu/tree.c:2285 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5928 Comm: kworker/1:8 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: events_power_efficient neigh_periodic_work RIP: 0010:rcu_read_lock include/linux/rcupdate.h:868 [inline] RIP: 0010:avc_reclaim_node security/selinux/avc.c:476 [inline] RIP: 0010:avc_alloc_node+0x46c/0x670 security/selinux/avc.c:507 Code: 24 4c 89 fe e8 f5 9b de 06 e9 6e fc ff ff e8 eb e3 6b fd e8 06 88 50 fd 31 ff 89 c6 88 44 24 08 e8 29 de 6b fd 0f b6 44 24 08 <84> c0 0f 85 f1 fd ff ff e8 c7 e3 6b fd e8 32 bc db 06 31 ff 89 c6 RSP: 0018:ffffc90000a079b0 EFLAGS: 00000046 RAX: 0000000000000001 RBX: 00000000000001d0 RCX: ffffffff849b1b67 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88803107c980 RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000200 R14: 0000000000000117 R15: 0000000000000202 FS: 0000000000000000(0000) GS:ffff8881246d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555556f544e8 CR3: 00000000475db000 CR4: 00000000003526f0 Call Trace: avc_insert security/selinux/avc.c:618 [inline] avc_compute_av+0x101/0x820 security/selinux/avc.c:993 avc_perm_nonode+0xb1/0x180 security/selinux/avc.c:1117 avc_has_perm_noaudit+0x2d4/0x3b0 security/selinux/avc.c:1160 avc_has_perm+0xbd/0x1e0 security/selinux/avc.c:1195 selinux_ip_postroute+0xc26/0xde0 security/selinux/hooks.c:6102 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK include/linux/netfilter.h:316 [inline] br_nf_post_routing+0xacf/0x16a0 net/bridge/br_netfilter_hooks.c:966 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK include/linux/netfilter.h:316 [inline] br_forward_finish+0x261/0x4d0 net/bridge/br_forward.c:66 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_forward_finish+0x693/0xb30 net/bridge/br_netfilter_hooks.c:662 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_nf_forward_ip.part.0+0x61e/0x820 net/bridge/br_netfilter_hooks.c:716 br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline] br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK include/linux/netfilter.h:316 [inline] __br_forward+0x2f6/0x970 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] br_flood+0x37f/0x650 net/bridge/br_forward.c:250 br_handle_frame_finish+0xf57/0x1f00 net/bridge/br_input.c:229 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0x6d7/0x3460 net/core/dev.c:6039 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265 process_backlog+0x37a/0x1580 net/core/dev.c:6617 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7896 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] neigh_periodic_work+0x6da/0xc10 net/core/neighbour.c:1039 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 audit_log_start: 17462 callbacks suppressed audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_lost=202021 audit_rate_limit=0 audit_backlog_limit=64 audit: audit_lost=202022 audit_rate_limit=0 audit_backlog_limit=64 audit: backlog limit exceeded audit: backlog limit exceeded audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_lost=202023 audit_rate_limit=0 audit_backlog_limit=64 audit: audit_lost=202024 audit_rate_limit=0 audit_backlog_limit=64 net_ratelimit: 333 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) audit_log_start: 18482 callbacks suppressed audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_lost=208185 audit_rate_limit=0 audit_backlog_limit=64 audit: backlog limit exceeded audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_lost=208186 audit_rate_limit=0 audit_backlog_limit=64 audit: backlog limit exceeded audit: audit_backlog=65 > audit_backlog_limit=64 audit: audit_lost=208187 audit_rate_limit=0 audit_backlog_limit=64 audit: backlog limit exceeded audit: audit_backlog=65 > audit_backlog_limit=64 net_ratelimit: 427 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:c9:b9:15:c7:d1, vlan:0)