bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
------------[ cut here ]------------
1
WARNING: kernel/rcu/tree_stall.h:1049 at rcu_check_gp_start_stall+0x2e4/0x470 kernel/rcu/tree_stall.h:1049, CPU#0: kworker/u9:3/5631
Modules linked in:
CPU: 0 UID: 0 PID: 5631 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: hci6 hci_cmd_sync_work
RIP: 0010:rcu_check_gp_start_stall+0x2e4/0x470 kernel/rcu/tree_stall.h:1049
Code: ff ff 48 c7 c7 20 95 48 9a be 04 00 00 00 e8 f3 91 85 00 4c 89 f7 b8 01 00 00 00 87 05 35 3d 9d 18 85 c0 0f 85 17 ff ff ff 90 <0f> 0b 90 48 81 ff 00 29 96 8e 74 47 48 c7 c0 c0 d6 30 90 48 c1 e8
RSP: 0000:ffffc90000007d98 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff81ab57dd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8e962900
RBP: ffffc90000007f18 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff34912a4 R12: 0000000000002904
R13: dffffc0000000000 R14: ffffffff8e962900 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125290000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0237b25f20 CR3: 0000000035e52000 CR4: 00000000003526f0
Call Trace:
rcu_core+0x3fe/0x1070 kernel/rcu/tree.c:2864
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__schedule+0x17bc/0x5680 kernel/sched/core.c:7148
Code: d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 4a c4 87 f6 4c 89 23 4c 89 ef 4c 89 e6 e8 3c 1c 8a f5 48 89 c7 e8 c4 bb eb f5 <31> ff 4d 39 e5 40 0f 95 c7 e8 a6 c7 eb f5 48 8b 84 24 00 01 00 00
RSP: 0000:ffffc900040a7220 EFLAGS: 00000206
RAX: 000000000042dc99 RBX: ffff8880b863ae88 RCX: 0000000080000001
RDX: 0000000000000007 RSI: ffffffff8dfa89a7 RDI: ffffffff8c28abe0
RBP: ffffc900040a7438 R08: ffffffff9030a3f7 R09: 1ffffffff206147e
R10: dffffc0000000000 R11: fffffbfff206147f R12: ffff888035a70000
R13: ffff888035a70000 R14: dffffc0000000000 R15: ffff8880b863b9f8
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7369
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
_raw_spin_unlock_irqrestore+0x74/0x80 kernel/locking/spinlock.c:198
__debug_check_no_obj_freed lib/debugobjects.c:1125 [inline]
debug_check_no_obj_freed+0x52e/0x550 lib/debugobjects.c:1146
__free_pages_prepare mm/page_alloc.c:1409 [inline]
__free_frozen_pages+0x593/0xd30 mm/page_alloc.c:2943
__slab_free+0x274/0x2c0 mm/slub.c:5608
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4950
__alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
alloc_skb include/linux/skbuff.h:1383 [inline]
mgmt_alloc_skb net/bluetooth/mgmt_util.c:64 [inline]
mgmt_send_event+0x46/0x190 net/bluetooth/mgmt_util.c:116
mgmt_event net/bluetooth/mgmt.c:340 [inline]
mgmt_connect_failed+0x322/0x4c0 net/bluetooth/mgmt.c:9911
hci_conn_failed+0xda/0x340 net/bluetooth/hci_conn.c:1331
hci_abort_conn_sync+0xdd0/0x1190 net/bluetooth/hci_sync.c:5763
hci_cmd_sync_work+0x213/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: d8 48 c1 fmuls -0x3f(%rax)
3: e8 03 42 80 3c call 0x3c80420b
8: 30 00 xor %al,(%rax)
a: 74 08 je 0x14
c: 48 89 df mov %rbx,%rdi
f: e8 4a c4 87 f6 call 0xf687c45e
14: 4c 89 23 mov %r12,(%rbx)
17: 4c 89 ef mov %r13,%rdi
1a: 4c 89 e6 mov %r12,%rsi
1d: e8 3c 1c 8a f5 call 0xf58a1c5e
22: 48 89 c7 mov %rax,%rdi
25: e8 c4 bb eb f5 call 0xf5ebbbee
* 2a: 31 ff xor %edi,%edi <-- trapping instruction
2c: 4d 39 e5 cmp %r12,%r13
2f: 40 0f 95 c7 setne %dil
33: e8 a6 c7 eb f5 call 0xf5ebc7de
38: 48 8b 84 24 00 01 00 mov 0x100(%rsp),%rax
3f: 00