bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P15765/1:b..l
rcu: 	(detected by 0, t=10503 jiffies, g=85601, q=1887 ncpus=2)
task:syz.9.2049      state:R  running task     stack:23984 pid:15765 tgid:15758 ppid:10694  task_flags:0x40044c flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7087
 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__rcu_read_unlock+0x70/0x110 kernel/rcu/tree_plugin.h:441
Code: 76 41 89 6d 00 85 ed 75 21 4d 8d be 48 04 00 00 4c 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 88 00 00 00 41 83 3f 00 75 29 <42> 0f b6 04 23 84 c0 75 62 41 8b 45 00 3d 00 00 00 40 73 0f 5b 41
RSP: 0018:ffffc9000b84f308 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 1ffff11005f84448 RCX: ffffc9000b84f203
RDX: 0000000000000002 RSI: ffffffff8c2ac600 RDI: ffffffff8c8100a0
RBP: 0000000000000001 R08: ffffffff903cfa77 R09: 1ffffffff2079f4e
R10: dffffc0000000000 R11: fffffbfff2079f4f R12: dffffc0000000000
R13: ffff88802fc22244 R14: ffff88802fc21e00 R15: dffffc0000000000
 rcu_read_unlock include/linux/rcupdate.h:882 [inline]
 percpu_ref_tryget_many include/linux/percpu-refcount.h:250 [inline]
 percpu_ref_tryget+0xfc/0x180 include/linux/percpu-refcount.h:266
 css_tryget include/linux/cgroup_refcnt.h:45 [inline]
 get_mem_cgroup_from_objcg+0x108/0x1d0 include/linux/memcontrol.h:501
 obj_cgroup_uncharge_pages+0x85/0x210 mm/memcontrol.c:2620
 refill_obj_stock+0x426/0x650 mm/memcontrol.c:2896
 obj_cgroup_uncharge mm/memcontrol.c:2945 [inline]
 __memcg_slab_free_hook+0x1df/0x310 mm/memcontrol.c:3032
 memcg_slab_free_hook mm/slub.c:2178 [inline]
 slab_free mm/slub.c:4606 [inline]
 kmem_cache_free+0x222/0x410 mm/slub.c:4711
 sk_prot_free net/core/sock.c:2215 [inline]
 __sk_destruct+0x4fd/0x690 net/core/sock.c:2312
 unix_destruct_scm+0x1d3/0x220 net/unix/af_unix.c:1879
 skb_release_head_state+0x100/0x250 net/core/skbuff.c:1087
 skb_release_all net/core/skbuff.c:1098 [inline]
 __kfree_skb net/core/skbuff.c:1114 [inline]
 sk_skb_reason_drop+0x194/0x380 net/core/skbuff.c:1152
 kfree_skb_reason include/linux/skbuff.h:1271 [inline]
 unix_release_sock+0x9c8/0xd00 net/unix/af_unix.c:721
 unix_release+0x91/0xc0 net/unix/af_unix.c:1106
 __sock_release net/socket.c:647 [inline]
 sock_close+0xbc/0x240 net/socket.c:1398
 __fput+0x3e9/0x9f0 fs/file_table.c:464
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xa2a/0x2940 kernel/exit.c:938
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 get_signal+0x168c/0x1720 kernel/signal.c:3036
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f846d98d169
RSP: 002b:00007f846e8620e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f846dba6248 RCX: 00007f846d98d169
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f846dba6248
RBP: 00007f846dba6240 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f846dba624c
R13: 0000000000000000 R14: 00007f846dccf940 R15: 00007f846dccfa28
 </TASK>
rcu: rcu_preempt kthread starved for 9283 jiffies! g85601 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26104 pid:18    tgid:18    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 schedule_timeout+0x15a/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2024
 rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2226
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3507 Comm: kworker/u8:7 Not tainted 6.14.0-rc7-syzkaller-00074-ga7f2e10ecd8f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:stack_trace_consume_entry+0x12f/0x280 kernel/stacktrace.c:95
Code: b3 7b 00 4d 89 f9 4c 89 ee 4c 89 f2 48 89 33 41 8b 19 41 0f b6 04 14 84 c0 0f 85 34 01 00 00 3b 5d 00 0f 92 c0 48 83 c4 18 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 44 89 c9 80 e1 07 80 c1
RSP: 0018:ffffc90000a272f0 EFLAGS: 00000286
RAX: 0000000000000001 RBX: ffffc90000a27320 RCX: ffffffff919e1000
RDX: dffffc0000000000 RSI: ffffffff82291900 RDI: ffffc90000a2740c
RBP: ffffc90000a27408 R08: 0000000000000001 R09: ffffc90000a27410
R10: ffffc90000a27370 R11: ffffffff81ad6cb0 R12: 1ffff92000144e81
R13: 1ffff92000144e81 R14: 0000000000000002 R15: 1ffff92000144e82
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2d32aceccc CR3: 000000006ab9a000 CR4: 00000000003526f0
DR0: 00000000ffffff18 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 arch_stack_walk+0x10e/0x150 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kmem_cache_free+0x195/0x410 mm/slub.c:4711
 br_nf_dev_queue_xmit+0x4c8/0x2550
 NF_HOOK+0x700/0x7c0 include/linux/netfilter.h:314
 br_nf_post_routing+0xa20/0xe80 net/bridge/br_netfilter_hooks.c:969
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK+0x2a7/0x460 include/linux/netfilter.h:312
 br_forward_finish+0xd8/0x130 net/bridge/br_forward.c:66
 br_nf_forward_finish+0xb49/0xfb0 net/bridge/br_netfilter_hooks.c:665
 NF_HOOK+0x700/0x7c0 include/linux/netfilter.h:314
 br_nf_forward_ip+0x61e/0x7b0 net/bridge/br_netfilter_hooks.c:719
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK+0x2a7/0x460 include/linux/netfilter.h:312
 __br_forward+0x489/0x660 net/bridge/br_forward.c:115
 br_handle_frame_finish+0x18d2/0x2000 net/bridge/br_input.c:220
 br_nf_hook_thresh+0x472/0x590
 br_nf_pre_routing_finish_ipv6+0xaa0/0xdd0
 NF_HOOK include/linux/netfilter.h:314 [inline]
 br_nf_pre_routing_ipv6+0x379/0x770 net/bridge/br_netfilter_ipv6.c:184
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:282 [inline]
 br_handle_frame+0x9f3/0x1530 net/bridge/br_input.c:433
 __netif_receive_skb_core+0x13e7/0x4540 net/core/dev.c:5790
 __netif_receive_skb_one_core net/core/dev.c:5894 [inline]
 __netif_receive_skb+0x12f/0x650 net/core/dev.c:6009
 process_backlog+0x662/0x15b0 net/core/dev.c:6357
 __napi_poll+0xcb/0x490 net/core/dev.c:7191
 napi_poll net/core/dev.c:7260 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7382
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 do_softirq+0x11b/0x1e0 kernel/softirq.c:462
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:389
 ieee80211_rx_bss_info net/mac80211/ibss.c:1174 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1581 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1b48/0x2e00 net/mac80211/ibss.c:1608
 ieee80211_iface_process_skb net/mac80211/iface.c:1612 [inline]
 ieee80211_iface_work+0x8dc/0xf90 net/mac80211/iface.c:1666
 cfg80211_wiphy_work+0x2f0/0x490 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
 worker_thread+0x870/0xd30 kernel/workqueue.c:3400
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
net_ratelimit: 25803 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:4a:1a:43:15:cd:56, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:4a:1a:43:15:cd:56, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 28581 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:4a:1a:43:15:cd:56, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:4a:1a:43:15:cd:56, vlan:0)