bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P31756/1:b..l rcu: (detected by 0, t=10502 jiffies, g=274005, q=1050 ncpus=1) task:syz.6.5444 state:R running task stack:23680 pid:31756 tgid:31755 ppid:22975 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_acquire+0x5e/0x330 kernel/locking/lockdep.c:5872 Code: 05 bb e9 25 12 83 f8 07 0f 87 a4 02 00 00 48 0f a3 05 46 ff f5 0e 0f 82 6f 02 00 00 8b 35 3e 32 f6 0e 85 f6 0f 85 8a 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d e9 25 12 0f 85 b8 02 00 00 48 83 c4 RSP: 0018:ffffc9000bedf6d0 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8de4ddbd RDI: ffffffff8c1ad620 RBP: ffffffff8e7e7460 R08: 00000000ae5f00db R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5177 [inline] __kvmalloc_node_noprof+0x360/0xa00 mm/slub.c:6668 alloc_netdev_mqs+0xd7/0x14f0 net/core/dev.c:12012 ip6gre_init_net+0x9e/0x420 net/ipv6/ip6_gre.c:1592 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x118/0x3a0 net/core/net_namespace.c:446 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:581 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:130 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x455/0xab0 kernel/fork.c:3174 __do_sys_unshare kernel/fork.c:3245 [inline] __se_sys_unshare kernel/fork.c:3243 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3243 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff481b9bf79 RSP: 002b:00007ff4829d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007ff481e15fa0 RCX: 00007ff481b9bf79 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 RBP: 00007ff481c327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff481e16038 R14: 00007ff481e15fa0 R15: 00007ffd411b4c08 rcu: rcu_preempt kthread starved for 565 jiffies! g274005 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28584 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x6020 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 27341 Comm: kworker/u10:21 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:lock_acquire+0x5e/0x330 kernel/locking/lockdep.c:5872 Code: 05 bb e9 25 12 83 f8 07 0f 87 a4 02 00 00 48 0f a3 05 46 ff f5 0e 0f 82 6f 02 00 00 8b 35 3e 32 f6 0e 85 f6 0f 85 8a 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d e9 25 12 0f 85 b8 02 00 00 48 83 c4 RSP: 0018:ffffc90000006100 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffffff8de4ddbd RDI: ffffffff8c1ad620 RBP: ffffffff8e7e7460 R08: 00000000a0f10c3c R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124392000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005654ca4a5a38 CR3: 000000000e596000 CR4: 00000000003526f0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2670 [inline] slab_free mm/slub.c:6082 [inline] kmem_cache_free+0x124/0x670 mm/slub.c:6212 skb_kfree_head net/core/skbuff.c:1087 [inline] skb_kfree_head net/core/skbuff.c:1084 [inline] skb_free_head+0x1c6/0x220 net/core/skbuff.c:1101 skb_release_data+0x79b/0x9d0 net/core/skbuff.c:1128 skb_release_all net/core/skbuff.c:1203 [inline] __kfree_skb net/core/skbuff.c:1217 [inline] sk_skb_reason_drop+0x102/0x1b0 net/core/skbuff.c:1255 kfree_skb_reason include/linux/skbuff.h:1322 [inline] kfree_skb include/linux/skbuff.h:1331 [inline] ip_tunnel_xmit+0x8e8/0x3200 net/ipv4/ip_tunnel.c:855 __gre_xmit+0x820/0xb20 net/ipv4/ip_gre.c:490 gre_tap_xmit+0x3b3/0x630 net/ipv4/ip_gre.c:778 __netdev_start_xmit include/linux/netdevice.h:5275 [inline] netdev_start_xmit include/linux/netdevice.h:5284 [inline] xmit_one net/core/dev.c:3864 [inline] dev_hard_start_xmit+0x127/0x6c0 net/core/dev.c:3880 sch_direct_xmit+0x1b2/0xc60 net/sched/sch_generic.c:347 __dev_xmit_skb net/core/dev.c:4179 [inline] __dev_queue_xmit+0x24bd/0x46f0 net/core/dev.c:4795 dev_queue_xmit include/linux/netdevice.h:3384 [inline] br_dev_queue_push_xmit+0x360/0x550 net/bridge/br_forward.c:53 br_nf_dev_queue_xmit+0x741/0x2a20 net/bridge/br_netfilter_hooks.c:920 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_nf_post_routing+0xcbb/0x16a0 net/bridge/br_netfilter_hooks.c:966 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK include/linux/netfilter.h:316 [inline] br_forward_finish+0x261/0x4d0 net/bridge/br_forward.c:66 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_forward_finish+0x693/0xb30 net/bridge/br_netfilter_hooks.c:662 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_nf_forward_ip.part.0+0x61e/0x820 net/bridge/br_netfilter_hooks.c:716 br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline] br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK include/linux/netfilter.h:316 [inline] __br_forward+0x2f6/0x970 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] maybe_deliver+0xf0/0x180 net/bridge/br_forward.c:191 br_flood+0x193/0x650 net/bridge/br_forward.c:238 br_handle_frame_finish+0xf57/0x1f00 net/bridge/br_input.c:229 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0x6c2/0x34f0 net/core/dev.c:6036 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6147 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6262 process_backlog+0x37a/0x1580 net/core/dev.c:6614 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7893 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:395 [inline] batadv_tt_local_purge+0x21c/0x3d0 net/batman-adv/translation-table.c:1315 batadv_tt_purge+0x8b/0xbd0 net/batman-adv/translation-table.c:3509 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 net_ratelimit: 9087 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) net_ratelimit: 13307 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:e6:59:1f:76:4b:2f, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)