bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P13223/2:b.el rcu: (detected by 0, t=10503 jiffies, g=197601, q=2982 ncpus=2) task:syz.4.9715 state:R running task stack:23000 pid:13223 tgid:13186 ppid:10760 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7051 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __local_bh_enable_ip+0xe1/0x130 kernel/softirq.c:457 local_bh_enable include/linux/bottom_half.h:33 [inline] __alloc_skb+0x1aa/0x7d0 net/core/skbuff.c:697 alloc_skb include/linux/skbuff.h:1383 [inline] ip_frag_next+0xd1/0xa60 net/ipv4/ip_output.c:694 ip_do_fragment+0x76d/0x1770 net/ipv4/ip_output.c:904 ip_finish_output_gso net/ipv4/ip_output.c:288 [inline] __ip_finish_output net/ipv4/ip_output.c:310 [inline] ip_finish_output+0x2e3/0x3f0 net/ipv4/ip_output.c:325 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 ip_local_out net/ipv4/ip_output.c:131 [inline] __ip_queue_xmit+0x1198/0x1be0 net/ipv4/ip_output.c:534 __tcp_transmit_skb+0x2b30/0x43e0 net/ipv4/tcp_output.c:1693 tcp_transmit_skb net/ipv4/tcp_output.c:1711 [inline] tcp_write_xmit+0x16e8/0x6980 net/ipv4/tcp_output.c:3064 __tcp_push_pending_frames+0x97/0x380 net/ipv4/tcp_output.c:3247 tcp_push_pending_frames include/net/tcp.h:2282 [inline] tcp_data_snd_check net/ipv4/tcp_input.c:6130 [inline] tcp_rcv_established+0x12ff/0x2670 net/ipv4/tcp_input.c:6712 tcp_v4_do_rcv+0xa90/0x1430 net/ipv4/tcp_ipv4.c:1880 sk_backlog_rcv include/net/sock.h:1185 [inline] __release_sock+0x265/0x3a0 net/core/sock.c:3213 release_sock+0x5f/0x1f0 net/core/sock.c:3795 sk_stream_wait_memory+0x72b/0xf80 net/core/stream.c:149 tcp_sendmsg_locked+0x2361/0x5430 net/ipv4/tcp.c:1417 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1464 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x627/0x7a0 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc06979bf79 RSP: 002b:00007fc06a695028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fc069a16270 RCX: 00007fc06979bf79 RDX: fffffffffffffe88 RSI: 00002000000002c0 RDI: 0000000000000005 RBP: 00007fc0698327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc069a16308 R14: 00007fc069a16270 R15: 00007fff509c7228 rcu: rcu_preempt kthread starved for 400 jiffies! g197601 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:27448 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x312/0x1560 kernel/rcu/tree.c:2083 rcu_gp_kthread+0x9d/0x3b0 kernel/rcu/tree.c:2285 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 21740 Comm: kworker/u8:33 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:__sanitizer_cov_trace_cmp8+0x0/0x90 kernel/kcov.c:293 Code: 11 10 48 89 74 11 18 48 89 44 11 20 e9 c9 b9 d6 09 cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 48 16 2f 11 65 8b 15 69 16 2f RSP: 0018:ffffc90000a08b80 EFLAGS: 00000282 RAX: ffffffff89a1a523 RBX: ffffff2147aea913 RCX: ffff88802bd4db80 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffff2147aea913 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000141174 R12: dffffc0000000000 R13: 0019999999999998 R14: ffffc9000eedb160 R15: ffffff2147aea913 FS: 0000000000000000(0000) GS:ffff8881257e9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f28eb9fff38 CR3: 000000000e346000 CR4: 00000000003526f0 Call Trace: pie_calculate_probability+0x3cb/0x7e0 net/sched/sch_pie.c:394 fq_pie_timer+0x288/0x5b0 net/sched/sch_fq_pie.c:402 call_timer_fn+0x192/0x5a0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xce5/0x1270 kernel/smp.c:877 Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 c4 db 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 6f d7 0b 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 53 d7 RSP: 0018:ffffc9000dcbf6a0 EFLAGS: 00000293 RAX: ffffffff81b87ffd RBX: 1ffff110170c856d RCX: ffff88802bd4db80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc9000dcbf7e0 R08: ffffffff8fef4a77 R09: 1ffffffff1fde94e R10: dffffc0000000000 R11: fffffbfff1fde94f R12: ffff8880b8642b68 R13: dffffc0000000000 R14: ffff8880b873bb00 R15: 0000000000000000 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043 on_each_cpu include/linux/smp.h:71 [inline] smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2711 [inline] smp_text_poke_batch_finish+0x5f5/0x1160 arch/x86/kernel/alternative.c:2921 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:894 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 net_ratelimit: 25591 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:6f:07:4d:dc:9b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) net_ratelimit: 33513 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)