bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5935/2:b..l
rcu: (detected by 0, t=10503 jiffies, g=11373, q=6082 ncpus=2)
task:syz.0.10 state:R running task stack:24584 pid:5935 tgid:5934 ppid:5831 task_flags:0x20400140 flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7238
irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x16/0x380 kernel/locking/lockdep.c:5828
Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 89 f6 41 55 45 89 c5 41 54 41 89 cc 55 <48> 89 fd 53 89 d3 48 83 ec 38 65 4c 8b 3d 20 8d 29 12 4c 89 7c 24
RSP: 0018:ffffc900042e6920 EFLAGS: 00000246
RAX: ffffffff81b7bffd RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e7e7760
RBP: ffffc900042e6a10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000200 R11: 000000000003ce77 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88802e2edb80
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kmalloc_noprof include/linux/slab.h:950 [inline]
slab_free_hook mm/slub.c:2637 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x41f/0x6a0 mm/slub.c:6295
mempool_free+0xde/0x130 mm/mempool.c:711
bio_put_percpu_cache block/bio.c:845 [inline]
bio_put+0x34f/0x5b0 block/bio.c:864
bio_endio+0x7a3/0x910 block/bio.c:1792
blk_update_request+0x741/0x13a0 block/blk-mq.c:1016
blk_mq_end_request+0x5b/0x420 block/blk-mq.c:1178
blk_mq_complete_request block/blk-mq.c:1356 [inline]
blk_mq_complete_request+0x8b/0xb0 block/blk-mq.c:1353
nullb_complete_cmd drivers/block/null_blk/main.c:1412 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1464 [inline]
null_queue_rq+0xb48/0xfb0 drivers/block/null_blk/main.c:1703
null_queue_rqs+0xe9/0x2f0 drivers/block/null_blk/main.c:1717
__blk_mq_flush_list block/blk-mq.c:2858 [inline]
__blk_mq_flush_list+0x9a/0xc0 block/blk-mq.c:2854
blk_mq_dispatch_queue_requests+0x184/0x7c0 block/blk-mq.c:2903
blk_mq_flush_plug_list+0x1f2/0x600 block/blk-mq.c:2991
blk_add_rq_to_plug+0x1ca/0x540 block/blk-mq.c:1417
blk_mq_submit_bio+0x1bda/0x2bf0 block/blk-mq.c:3243
__submit_bio+0x1e1/0x6c0 block/blk-core.c:635
__submit_bio_noacct_mq block/blk-core.c:722 [inline]
submit_bio_noacct_nocheck+0x562/0xc10 block/blk-core.c:753
submit_bio_noacct+0xd17/0x2010 block/blk-core.c:884
blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
submit_bh_wbc+0x59c/0x770 fs/buffer.c:2821
__block_write_full_folio+0x77f/0xee0 fs/buffer.c:1930
block_write_full_folio+0x3b5/0x4e0 fs/buffer.c:2750
blkdev_writepages+0xc7/0x150 block/fops.c:486
do_writepages+0x278/0x600 mm/page-writeback.c:2554
filemap_writeback+0x22d/0x2e0 mm/filemap.c:387
filemap_fdatawrite_range mm/filemap.c:412 [inline]
filemap_write_and_wait_range mm/filemap.c:684 [inline]
filemap_write_and_wait_range+0xa6/0x130 mm/filemap.c:675
filemap_write_and_wait include/linux/pagemap.h:65 [inline]
sync_blockdev block/bdev.c:276 [inline]
sync_blockdev block/bdev.c:272 [inline]
bdev_release+0x4d3/0x6d0 block/bdev.c:1142
blkdev_release+0x15/0x20 block/fops.c:705
__fput+0x3ff/0xb40 fs/file_table.c:469
task_work_run+0x150/0x240 kernel/task_work.c:233
get_signal+0x1bd/0x21e0 kernel/signal.c:2807
arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6bea59c819
RSP: 002b:00007f6beb47a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: 0000000000e00000 RBX: 00007f6bea815fa0 RCX: 00007f6bea59c819
RDX: 0000000080000000 RSI: 0000200000000040 RDI: 0000000000000003
RBP: 00007f6bea632c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6bea816038 R14: 00007f6bea815fa0 R15: 00007ffde4f32798
rcu: rcu_preempt kthread starved for 297 jiffies! g11373 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27832 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xfee/0x6120 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7008
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3408 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:202 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:232 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:_ieee80211_hw_check include/net/mac80211.h:3149 [inline]
RIP: 0010:ieee80211_rx_monitor net/mac80211/rx.c:893 [inline]
RIP: 0010:ieee80211_rx_list+0x1331/0x2fc0 net/mac80211/rx.c:5579
Code: f3 ff ff e8 c1 57 fd f6 48 8b 04 24 be 08 00 00 00 48 8d 58 60 48 89 df e8 5c f5 68 f7 48 89 da 48 b8 00 00 00 00 00 fc ff df <48> c1 ea 03 80 3c 02 00 0f 85 6e 19 00 00 48 8b 04 24 4c 8d 7d 70
RSP: 0018:ffffc90000a08c50 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff88801fee8f20 RCX: ffffffff8b0af154
RDX: ffff88801fee8f20 RSI: 0000000000000008 RDI: ffff88801fee8f20
RBP: ffff888080d908c0 R08: 0000000000000000 R09: ffffed1003fdd1e4
R10: ffff88801fee8f27 R11: 0000000000000000 R12: ffff888080d90998
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124440000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd72f70dcc CR3: 000000007769c000 CR4: 00000000003526f0
Call Trace:
ieee80211_rx_napi+0xdc/0x400 net/mac80211/rx.c:5611
ieee80211_rx include/net/mac80211.h:5267 [inline]
ieee80211_handle_queued_frames+0xc8/0x120 net/mac80211/main.c:452
tasklet_action_common+0x2de/0x3d0 kernel/softirq.c:925
handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:395 [inline]
__batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:185
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline]
batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204
process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
process_scheduled_works kernel/workqueue.c:3359 [inline]
rescuer_thread+0x905/0x14a0 kernel/workqueue.c:3583
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 17587 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 17697 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:da:71:71:a4:9d:94, vlan:0)