bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-...!: (1 GPs behind) idle=112c/1/0x4000000000000000 softirq=139363/139371 fqs=2 rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5187/1:b..l rcu: (detected by 0, t=10502 jiffies, g=134965, q=525 ncpus=2) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31067 Comm: syz.2.6985 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:107 [inline] RIP: 0010:raw_atomic_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:2170 [inline] RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1302 [inline] RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] RIP: 0010:do_raw_spin_lock+0x125/0x290 kernel/locking/spinlock_debug.c:116 Code: 00 00 c7 44 24 40 00 00 00 00 48 89 df be 04 00 00 00 e8 ee 8a 88 00 48 8d 7c 24 40 be 04 00 00 00 e8 df 8a 88 00 8b 44 24 40 01 00 00 00 f0 0f b1 0b 0f 85 dd 00 00 00 65 8b 1d 69 80 e1 10 RSP: 0018:ffffc90000a08bc0 EFLAGS: 00000097 RAX: 0000000000000000 RBX: ffffffff99b289e8 RCX: ffffffff819e8fb1 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000a08c00 RBP: ffffc90000a08c80 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000141180 R12: ffffffff99b289f8 R13: ffffffff99b289f0 R14: 1ffffffff336513f R15: 1ffffffff336513e FS: 00007f873525e6c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c26b2ca CR3: 0000000023f3c000 CR4: 00000000003526f0 Call Trace: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0x4c/0x60 kernel/locking/spinlock.c:162 debug_object_activate+0x87/0x540 lib/debugobjects.c:818 debug_hrtimer_activate kernel/time/hrtimer.c:438 [inline] debug_activate kernel/time/hrtimer.c:477 [inline] enqueue_hrtimer+0x30/0x380 kernel/time/hrtimer.c:1081 __run_hrtimer kernel/time/hrtimer.c:1794 [inline] __hrtimer_run_queues+0x636/0xc30 kernel/time/hrtimer.c:1841 hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline] __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__kasan_check_byte+0x12/0x40 mm/kasan/common.c:573 Code: ff 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 41 56 53 48 89 f3 49 89 fe e8 3e 15 00 00 <84> c0 75 16 be 01 00 00 00 4c 89 f7 31 d2 48 89 d9 89 c3 e8 36 04 RSP: 0018:ffffc90010bcf020 EFLAGS: 00000293 RAX: 0000000000000001 RBX: ffffffff8173fd82 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff8173fd82 RDI: 1ffffffff1be8354 RBP: ffffffff8173fd65 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc90010bcf1f8 R11: ffffffff81acf3d0 R12: 0000000000000002 R13: ffffffff8df41aa0 R14: ffffffff8df41aa0 R15: 0000000000000000 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire+0x84/0x340 kernel/locking/lockdep.c:5842 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0xc2/0x23d0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556 kvfree_call_rcu+0x106/0x440 mm/slab_common.c:1994 sctp_bind_addr_clean net/sctp/bind_addr.c:131 [inline] sctp_bind_addr_free+0x12f/0x170 net/sctp/bind_addr.c:140 sctp_association_free+0x2b6/0x7f0 net/sctp/associola.c:357 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:950 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1336 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline] sctp_do_sm+0x3efe/0x5c40 net/sctp/sm_sideeffect.c:1175 sctp_primitive_SHUTDOWN+0x98/0xc0 net/sctp/primitive.c:89 sctp_close+0x409/0x930 net/sctp/socket.c:1529 inet_release+0x144/0x190 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0xc3/0x240 net/socket.c:1455 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 get_signal+0x11ec/0x1340 kernel/signal.c:2807 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x87/0x4e0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2b7/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f873438f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f873525e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: fffffffffffffe00 RBX: 00007f87345e5fa0 RCX: 00007f873438f749 RDX: 000000000000001c RSI: 0000200000004080 RDI: 0000000000000003 RBP: 00007f8734413f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f87345e6038 R14: 00007f87345e5fa0 R15: 00007fffc584e2d8 task:klogd state:R running task stack:23288 pid:5187 tgid:5187 ppid:1 task_flags:0x400100 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7190 irqentry_exit+0x5d8/0x660 kernel/entry/common.c:216 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x222/0x340 kernel/locking/lockdep.c:5872 Code: ff ff ff e8 00 a1 bb 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 0a 20 e2 10 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 37 77 e7 RSP: 0018:ffffc90003087198 EFLAGS: 00000282 RAX: 004ffbc40f134f00 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 00000000a9580588 RSI: ffffffff8d975f6e RDI: ffffffff8bc083e0 RBP: ffffffff8173fd65 R08: ffffffff8173fd65 R09: ffffffff8df41aa0 R10: ffffc900030872f8 R11: ffffffff81acf3d0 R12: 0000000000000002 R13: ffffffff8df41aa0 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0xc2/0x23d0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 save_stack+0xf5/0x1f0 mm/page_owner.c:165 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xbc8/0xd30 mm/page_alloc.c:2943 discard_slab mm/slub.c:3346 [inline] __put_partials+0x146/0x170 mm/slub.c:3886 __slab_free+0x294/0x320 mm/slub.c:5952 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_kmalloc+0x22/0xb0 mm/kasan/common.c:406 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_node_track_caller_noprof+0x575/0x820 mm/slub.c:5764 kmalloc_reserve+0x136/0x290 net/core/skbuff.c:608 __alloc_skb+0x204/0x3a0 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xca/0x890 net/core/skbuff.c:6712 sock_alloc_send_pskb+0x84d/0x980 net/core/sock.c:2995 unix_dgram_sendmsg+0x454/0x1840 net/unix/af_unix.c:2130 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f82288e6407 RSP: 002b:00007ffcd2f6f330 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f8228796c80 RCX: 00007f82288e6407 RDX: 00000000000000a1 RSI: 00007ffcd2f6f470 RDI: 0000000000000003 RBP: 00007ffcd2f6f8a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffcd2f6f8b8 R13: 00007ffcd2f6f470 R14: 0000000000000086 R15: 00007ffcd2f6f470 rcu: rcu_preempt kthread starved for 10494 jiffies! g134965 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28008 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_timeout+0x12b/0x270 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x301/0x1540 kernel/rcu/tree.c:2083 rcu_gp_kthread+0x99/0x390 kernel/rcu/tree.c:2285 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 16998 Comm: kworker/u8:41 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:lock_acquire+0x222/0x340 kernel/locking/lockdep.c:5872 Code: ff ff ff e8 00 a1 bb 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 0a 20 e2 10 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 37 77 e7 RSP: 0018:ffffc90000006d58 EFLAGS: 00000282 RAX: 4d88d7fe638e7100 RBX: 0000000000000000 RCX: 0000000000000101 RDX: 000000008eba6367 RSI: ffffffff8d975f6e RDI: ffffffff8bc083e0 RBP: ffffffff8173fd65 R08: ffffffff8173fd65 R09: ffffffff8df41aa0 R10: ffffc90000006eb8 R11: ffffffff81acf3d0 R12: 0000000000000002 R13: ffffffff8df41aa0 R14: 0000000000000000 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9369057f98 CR3: 000000000dd3a000 CR4: 00000000003526f0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0xc2/0x23d0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270 skb_clone+0x212/0x3a0 net/core/skbuff.c:2087 deliver_clone net/bridge/br_forward.c:125 [inline] maybe_deliver+0x98/0x160 net/bridge/br_forward.c:191 br_flood+0x31a/0x6a0 net/bridge/br_forward.c:238 br_handle_frame_finish+0x15a3/0x1c90 net/bridge/br_input.c:229 br_nf_hook_thresh+0x3c6/0x4a0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0x999/0xd60 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x37e/0x6b0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x96e/0x14f0 net/bridge/br_input.c:442 __netif_receive_skb_core+0x95f/0x2f90 net/core/dev.c:6026 __netif_receive_skb_one_core net/core/dev.c:6137 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6252 process_backlog+0x54f/0x1340 net/core/dev.c:6604 __napi_poll+0xae/0x320 net/core/dev.c:7668 napi_poll net/core/dev.c:7731 [inline] net_rx_action+0x64a/0xe00 net/core/dev.c:7883 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xcce/0x1260 kernel/smp.c:877 Code: 01 31 ff e8 e4 97 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 8f 93 0b 00 eb 38 f3 90 42 0f b6 04 2b 84 c0 75 11 <41> f7 04 24 01 00 00 00 74 1e e8 73 93 0b 00 eb e4 44 89 e1 80 e1 RSP: 0018:ffffc90003b7f6a0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 1ffff110170e8129 RCX: ffff888058583d00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90003b7f7e0 R08: ffffffff8f822277 R09: 1ffffffff1f0444e R10: dffffc0000000000 R11: fffffbfff1f0444f R12: ffff8880b8740948 R13: dffffc0000000000 R14: ffff8880b863bb00 R15: 0000000000000001 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043 on_each_cpu include/linux/smp.h:71 [inline] smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2711 [inline] smp_text_poke_batch_finish+0x5f9/0x1130 arch/x86/kernel/alternative.c:2921 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 static_key_disable_cpuslocked+0xc5/0x1a0 kernel/jump_label.c:240 static_key_disable+0x1a/0x20 kernel/jump_label.c:248 toggle_allocation_gate+0x1a1/0x240 mm/kfence/core.c:879 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 net_ratelimit: 1396 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) net_ratelimit: 2642 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:82:e1:56:aa:b2:30, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)