bridge0: received packet on veth0_to_bridge with own address as source address (addr:2a:60:40:9a:24:68, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P5808/2:b..l P5820/1:b..l P6943/1:b..l P6950/1:b..l P6913/1:b..l P2/1:b..l P5181/1:b..l P5829/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=22677, q=1042 ncpus=1)
task:syz-executor    state:R  running task     stack:23864 pid:5829  tgid:5829  ppid:5817   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5872
Code: 05 7b ae 28 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 46 47 f5 0e 0f 82 c2 02 00 00 8b 35 0e 7b f5 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d ae 28 12 0f 85 02 03 00 00 48 83 c4
RSP: 0018:ffffc90003b36fd8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffffff8de5414a RDI: ffffffff8c1aeb20
RBP: ffffffff8e7e9220 R08: 0000000055297e28 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
 unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x162/0x1e0 mm/page_owner.c:165
 __reset_page_owner+0x84/0x190 mm/page_owner.c:320
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4837
 ptlock_alloc+0x1f/0x70 mm/memory.c:7456
 ptlock_init include/linux/mm.h:3494 [inline]
 pagetable_pte_ctor include/linux/mm.h:3548 [inline]
 __pte_alloc_one_noprof include/asm-generic/pgalloc.h:79 [inline]
 pte_alloc_one+0x84/0x3e0 arch/x86/mm/pgtable.c:18
 __pte_alloc+0x6d/0x3f0 mm/memory.c:466
 copy_pte_range mm/memory.c:1250 [inline]
 copy_pmd_range mm/memory.c:1405 [inline]
 copy_pud_range mm/memory.c:1442 [inline]
 copy_p4d_range mm/memory.c:1466 [inline]
 copy_page_range+0x3e51/0x6570 mm/memory.c:1552
 dup_mmap+0xd25/0x2180 mm/mmap.c:1841
 dup_mm kernel/fork.c:1530 [inline]
 copy_mm kernel/fork.c:1582 [inline]
 copy_process+0x73d7/0x7a10 kernel/fork.c:2223
 kernel_clone+0xfc/0x9a0 kernel/fork.c:2654
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2795
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba499c50d2
RSP: 002b:00007ffd2f979270 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffd2f979270 RCX: 00007fba499c50d2
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffd2f9793fc R08: 0000000000000000 R09: 0000000000000001
R10: 000055558e3457d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 00000000000268eb R15: 00007ffd2f979450
 </TASK>
task:klogd           state:R  running task     stack:25416 pid:5181  tgid:5181  ppid:1      task_flags:0x400100 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
 _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
 sock_def_readable+0x154/0x630 net/core/sock.c:3611
 unix_dgram_sendmsg+0xccd/0x1820 net/unix/af_unix.c:2281
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 __sys_sendto+0x4aa/0x520 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8680213407
RSP: 002b:00007ffd1d322aa0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f86800c3c80 RCX: 00007f8680213407
RDX: 00000000000000a0 RSI: 00007ffd1d322be0 RDI: 0000000000000003
RBP: 00007ffd1d323010 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffd1d323028
R13: 00007ffd1d322be0 R14: 0000000000000085 R15: 00007ffd1d322be0
 </TASK>
task:kthreadd        state:R  running task     stack:26448 pid:2     tgid:2     ppid:0      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_notrace+0x5f/0xd0 kernel/sched/core.c:7184
 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
 rcu_is_watching+0x8e/0xc0 kernel/rcu/tree.c:753
 rcu_read_lock_held_common kernel/rcu/update.c:109 [inline]
 rcu_read_lock_held+0x1e/0x50 kernel/rcu/update.c:349
 lookup_page_ext+0x6e/0x100 mm/page_ext.c:258
 page_ext_iter_begin include/linux/page_ext.h:133 [inline]
 __update_page_owner_free_handle.isra.0+0xa4/0x4d0 mm/page_owner.c:284
 __reset_page_owner+0x93/0x190 mm/page_owner.c:321
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4837
 alloc_pid+0x1bd/0x1890 kernel/pid.c:189
 copy_process+0x48f6/0x7a10 kernel/fork.c:2239
 kernel_clone+0xfc/0x9a0 kernel/fork.c:2654
 kernel_thread+0xdb/0x120 kernel/fork.c:2715
 create_kthread kernel/kthread.c:490 [inline]
 kthreadd+0x498/0x7a0 kernel/kthread.c:849
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz.3.190       state:R  running task     stack:26232 pid:6913  tgid:6903  ppid:5831   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:422 [inline]
RIP: 0010:unwind_next_frame+0x1500/0x1ea0 arch/x86/kernel/unwind_orc.c:663
Code: bf 69 02 ba 08 00 00 00 4c 89 ef 4d 8d 7d 34 4c 01 f5 48 89 ee e8 30 e9 ff ff 84 c0 0f 84 54 ee ff ff 48 89 ef e8 00 e3 ff ff <49> 8d 7d 40 48 89 fa 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1
RSP: 0018:ffffc90003ff7210 EFLAGS: 00000202
RAX: 1ffff920007fef12 RBX: 0000000000000001 RCX: ffffffff918c2672
RDX: ffffc90003ff7801 RSI: ffffc90003ff7858 RDI: ffffc90003ff7858
RBP: ffffc90003ff7858 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000001b6df R12: ffffc90003ff72d0
R13: ffffc90003ff7280 R14: ffffc90003ff7888 R15: ffffc90003ff72b4
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x162/0x1e0 mm/page_owner.c:165
 __reset_page_owner+0x84/0x190 mm/page_owner.c:320
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:406
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5219 [inline]
 __kmalloc_node_track_caller_noprof+0x304/0x850 mm/slub.c:5327
 __kmemdup_nul mm/util.c:64 [inline]
 kstrdup+0x51/0xe0 mm/util.c:84
 kstrdup_const+0x63/0x80 mm/util.c:104
 __kernfs_new_node+0x9b/0x960 fs/kernfs/dir.c:633
 kernfs_new_node+0x11b/0x1a0 fs/kernfs/dir.c:718
 kernfs_create_dir_ns+0x4c/0x1a0 fs/kernfs/dir.c:1088
 sysfs_create_dir_ns+0x13a/0x2b0 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x2c8/0x930 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_init_and_add+0x121/0x180 lib/kobject.c:457
 rx_queue_add_kobject net/core/net-sysfs.c:1260 [inline]
 net_rx_queue_update_kobjects+0x37e/0x760 net/core/net-sysfs.c:1322
 register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
 netdev_register_kobject+0x290/0x3d0 net/core/net-sysfs.c:2362
 register_netdevice+0x12e0/0x2210 net/core/dev.c:11413
 register_netdev+0x34/0x50 net/core/dev.c:11529
 ip6_tnl_init_net+0x2ff/0x480 net/ipv6/ip6_tunnel.c:2334
 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
 setup_net+0x118/0x3a0 net/core/net_namespace.c:446
 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:581
 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:130
 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x455/0xab0 kernel/fork.c:3174
 __do_sys_unshare kernel/fork.c:3245 [inline]
 __se_sys_unshare kernel/fork.c:3243 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3243
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd2b119c629
RSP: 002b:00007fd2b2098028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007fd2b1416270 RCX: 00007fd2b119c629
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080
RBP: 00007fd2b1232b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd2b1416308 R14: 00007fd2b1416270 R15: 00007fff70a4d3f8
 </TASK>
task:syz.1.195       state:R  running task     stack:23016 pid:6950  tgid:6950  ppid:6943   task_flags:0x40064c flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 zap_pte_range mm/memory.c:1959 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x152f/0x4840 mm/memory.c:2091
 unmap_single_vma+0x153/0x240 mm/memory.c:2133
 unmap_vmas+0x295/0x590 mm/memory.c:2171
 exit_mmap+0x1ef/0xa30 mm/mmap.c:1302
 __mmput+0x12a/0x410 kernel/fork.c:1174
 mmput+0x67/0x80 kernel/fork.c:1197
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2aa0 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
 irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7f74ea79c631
RSP: 002b:0000000020aa2890 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f74eaa16180 RCX: 00007f74ea79c629
RDX: 0000000000000000 RSI: 0000000020aa2890 RDI: 0000000000000002
RBP: 00007f74ea832b39 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f74eaa16218 R14: 00007f74eaa16180 R15: 00007ffc36fb7618
 </TASK>
task:syz.1.195       state:R  running task     stack:26536 pid:6943  tgid:6943  ppid:5821   task_flags:0x40044c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 zap_pte_range mm/memory.c:1959 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x152f/0x4840 mm/memory.c:2091
 unmap_single_vma+0x153/0x240 mm/memory.c:2133
 unmap_vmas+0x295/0x590 mm/memory.c:2171
 exit_mmap+0x1ef/0xa30 mm/mmap.c:1302
 __mmput+0x12a/0x410 kernel/fork.c:1174
 mmput+0x67/0x80 kernel/fork.c:1197
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2aa0 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f74ea75cece
RSP: 002b:00007ffc36fb76f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: 0000000000000000 RBX: 000055556b5c0500 RCX: 00007f74ea75cece
RDX: 00007ffc36fb7750 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f74eaa17da0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000026b33
R13: 00007f74eaa1609c R14: 00000000000269f3 R15: 00007f74eaa16090
 </TASK>
task:syz-executor    state:R  running task     stack:24664 pid:5820  tgid:5820  ppid:5808   task_flags:0x40050c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 zap_pte_range mm/memory.c:1959 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x152f/0x4840 mm/memory.c:2091
 unmap_single_vma+0x153/0x240 mm/memory.c:2133
 unmap_vmas+0x295/0x590 mm/memory.c:2171
 exit_mmap+0x1ef/0xa30 mm/mmap.c:1302
 __mmput+0x12a/0x410 kernel/fork.c:1174
 mmput+0x67/0x80 kernel/fork.c:1197
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2aa0 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd2b1157817
RSP: 002b:00007fff70a4d8e0 EFLAGS: 00000202 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 000055556666e500 RCX: 00007fd2b1157817
RDX: 0000000040000000 RSI: 00007fff70a4d93c RDI: ffffffffffffffff
RBP: 00007fff70a4d93c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007fff70a4db98 R15: 0000000000000000
 </TASK>
task:syz-executor    state:R  running task     stack:21960 pid:5808  tgid:5808  ppid:5807   task_flags:0x400100 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
 _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:407 [inline]
 unlock_task_sighand include/linux/sched/signal.h:748 [inline]
 do_send_sig_info kernel/signal.c:1270 [inline]
 group_send_sig_info+0x2d5/0x300 kernel/signal.c:1419
 kill_pid_info_type+0x92/0x290 kernel/signal.c:1459
 kill_pid_info kernel/signal.c:1473 [inline]
 kill_proc_info+0x6f/0x1b0 kernel/signal.c:1480
 kill_something_info+0x2a0/0x310 kernel/signal.c:1577
 __do_sys_kill kernel/signal.c:3953 [inline]
 __se_sys_kill kernel/signal.c:3947 [inline]
 __x64_sys_kill+0x1c4/0x250 kernel/signal.c:3947
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb67a93dc27
RSP: 002b:00007fff74af5588 EFLAGS: 00000202 ORIG_RAX: 000000000000003e
RAX: ffffffffffffffda RBX: 00005555816bfd50 RCX: 00007fb67a93dc27
RDX: 0000000000000003 RSI: 0000000000000009 RDI: 00000000000016bc
RBP: 00005555816bfd50 R08: 00005555816c38e0 R09: 00005555816c3900
R10: 00007fb67a800000 R11: 0000000000000202 R12: 00007fff74af559c
R13: 00005555816c14f8 R14: 00005555816c38f8 R15: 00007fff74af5650
 </TASK>
task:syz.2.196       state:R  running task     stack:26872 pid:6951  tgid:6951  ppid:5825   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7091
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:457
 nl80211_netlink_notify net/wireless/nl80211.c:21652 [inline]
 nl80211_netlink_notify+0x2fd/0x970 net/wireless/nl80211.c:21615
 notifier_call_chain+0x99/0x420 kernel/notifier.c:85
 blocking_notifier_call_chain kernel/notifier.c:380 [inline]
 blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:368
 netlink_release+0x166a/0x1ff0 net/netlink/af_netlink.c:761
 __sock_release+0xb3/0x260 net/socket.c:662
 sock_close+0x1c/0x30 net/socket.c:1455
 __fput+0x3ff/0xb40 fs/file_table.c:469
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0x100/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x668/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f708c79c629
RSP: 002b:00007fffcc1d0dd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f708ca17da0 RCX: 00007f708c79c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f708ca17da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f708ca17cb0 R11: 0000000000000246 R12: 0000000000026c64
R13: 00007f708ca1609c R14: 0000000000026aa9 R15: 00007f708ca16090
 </TASK>
task:syz.0.185       state:R  running task     stack:23168 pid:6897  tgid:6897  ppid:5829   task_flags:0x400640 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7234
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5872
Code: 05 7b ae 28 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 46 47 f5 0e 0f 82 c2 02 00 00 8b 35 0e 7b f5 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d ae 28 12 0f 85 02 03 00 00 48 83 c4
RSP: 0018:ffffc90004726d00 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8de5414a RDI: ffffffff8c1aeb20
RBP: ffffffff8e7e9220 R08: 00000000e7a69380 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 __pte_offset_map+0x40/0x310 mm/pgtable-generic.c:288
 pte_offset_map_lock+0x8d/0x320 mm/pgtable-generic.c:398
 follow_page_pte+0xab/0x1400 mm/gup.c:812
 follow_pmd_mask mm/gup.c:928 [inline]
 follow_pud_mask mm/gup.c:967 [inline]
 follow_p4d_mask mm/gup.c:984 [inline]
 follow_page_mask mm/gup.c:1023 [inline]
 __get_user_pages+0x745/0x34d0 mm/gup.c:1426
 __get_user_pages_locked mm/gup.c:1692 [inline]
 get_dump_page+0x27e/0x3d0 mm/gup.c:2192
 dump_user_range+0x18d/0xb50 fs/coredump.c:1367
 elf_core_dump+0x2d16/0x3c60 fs/binfmt_elf.c:2111
 coredump_write fs/coredump.c:1050 [inline]
 do_coredump fs/coredump.c:1127 [inline]
 vfs_coredump+0x27b4/0x5570 fs/coredump.c:1201
 get_signal+0x1f2a/0x21e0 kernel/signal.c:3019
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
 irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:612
RIP: 0033:0x7fba4999c631
RSP: 002b:0000200000000100 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fba49c16270 RCX: 00007fba4999c629
RDX: 0000200000000140 RSI: 0000200000000100 RDI: 0000000080800000
RBP: 00007fba49a32b39 R08: 0000200000000280 R09: 0000200000000280
R10: 0000200000000180 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fba49c16308 R14: 00007fba49c16270 R15: 00007ffd2f979058
 </TASK>
task:syz.0.185       state:R  running task     stack:23144 pid:6874  tgid:6874  ppid:5829   task_flags:0x400640 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 preempt_schedule_notrace+0x5f/0xd0 kernel/sched/core.c:7184
 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
 rcu_is_watching+0x8e/0xc0 kernel/rcu/tree.c:753
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x317/0x380 kernel/locking/lockdep.c:5831
 rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
 unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x162/0x1e0 mm/page_owner.c:165
 __set_page_owner+0x8c/0x540 mm/page_owner.c:341
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2485
 folio_alloc_mpol_noprof+0x36/0x340 mm/mempolicy.c:2504
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1930
 shmem_alloc_and_add_folio+0x371/0xd40 mm/shmem.c:1972
 shmem_get_folio_gfp+0x6ab/0x1900 mm/shmem.c:2567
 shmem_get_folio mm/shmem.c:2673 [inline]
 shmem_write_begin+0x1a4/0x420 mm/shmem.c:3327
 generic_perform_write+0x292/0xa40 mm/filemap.c:4314
 shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3502
 __kernel_write_iter+0x2ac/0x920 fs/read_write.c:621
 dump_emit_page fs/coredump.c:1299 [inline]
 dump_user_range+0x3f9/0xb50 fs/coredump.c:1373
 elf_core_dump+0x2d16/0x3c60 fs/binfmt_elf.c:2111
 coredump_write fs/coredump.c:1050 [inline]
 do_coredump fs/coredump.c:1127 [inline]
 vfs_coredump+0x27b4/0x5570 fs/coredump.c:1201
 get_signal+0x1f2a/0x21e0 kernel/signal.c:3019
 arch_do_signal_or_restart+0x91/0x770 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
 irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fba4999c631
RSP: 002b:fffffffffffffe10 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fba49c15fa0 RCX: 00007fba4999c629
RDX: 0000000000000000 RSI: fffffffffffffe10 RDI: 0000000000000000
RBP: 00007fba49a32b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fba49c16038 R14: 00007fba49c15fa0 R15: 00007ffd2f979058
 </TASK>
rcu: rcu_preempt kthread starved for 757 jiffies! g22677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28904 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x60e0 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7004
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2297
 kthread+0x370/0x450 kernel/kthread.c:467
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 3408 Comm: kworker/R-bat_e Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x8/0x20 kernel/kcov.c:300
Code: bf 06 00 00 00 e9 b8 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <40> 0f b6 d6 40 0f b6 f7 bf 01 00 00 00 e9 86 fe ff ff 66 0f 1f 44
RSP: 0018:ffffc900000074e0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88806251e400 RCX: ffffffff8a372838
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88806251e464 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff88806251e4df R14: ffff8880454d9000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124351000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb678b32414 CR3: 0000000035288000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __in6_dev_get include/net/addrconf.h:348 [inline]
 ip6_ignore_linkdown include/net/addrconf.h:449 [inline]
 find_match net/ipv6/route.c:780 [inline]
 __find_rr_leaf+0x658/0x1070 net/ipv6/route.c:868
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x50f/0xa10 net/ipv6/route.c:2246
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2282
 pol_lookup_func include/net/ip6_fib.h:617 [inline]
 fib6_rule_lookup+0x52f/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2351 [inline]
 ip6_route_input+0x662/0xc50 net/ipv6/route.c:2654
 ip6_rcv_finish_core.isra.0+0x1a9/0x5a0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x1e8/0x610 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6156
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6269
 process_backlog+0x37a/0x1580 net/core/dev.c:6621
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7685
 napi_poll net/core/dev.c:7748 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7900
 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:185
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline]
 batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204
 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
 process_scheduled_works kernel/workqueue.c:3358 [inline]
 rescuer_thread+0x902/0x1490 kernel/workqueue.c:3582
 kthread+0x370/0x450 kernel/kthread.c:467
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 1040 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:2a:60:40:9a:24:68, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:2a:60:40:9a:24:68, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
net_ratelimit: 8126 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:2a:60:40:9a:24:68, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:2a:60:40:9a:24:68, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)