TITLE: kernel panic: stack is corrupted in br_dev_xmit
TYPE: DoS
PANICKED: Y

[  254.788396] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
[  254.800034] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: br_dev_xmit+0x12ec/0x1550
[  254.800034] 
[  254.811975] CPU: 1 PID: 21341 Comm: syz-executor0 Not tainted 4.16.0+ #294
[  254.818978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  254.828322] Call Trace:
[  254.830892]  <IRQ>
[  254.833100]  dump_stack+0x1a7/0x27d
[  254.845262]  panic+0x1f8/0x42c
[  254.874451]  __stack_chk_fail+0x22/0x30
[  254.878417]  br_dev_xmit+0x12ec/0x1550
[  254.919010]  dev_hard_start_xmit+0x24e/0xac0
[  254.934421] sctp: [Deprecated]: syz-executor4 (pid 21370) Use of int in maxseg socket option.
[  254.934421] Use struct sctp_assoc_value instead
[  254.980126]  __dev_queue_xmit+0x26cf/0x2fd0
[  255.014107] sctp: [Deprecated]: syz-executor4 (pid 21373) Use of int in maxseg socket option.
[  255.014107] Use struct sctp_assoc_value instead
[  255.053307] kernel msg: ebtables bug: please report to author: Valid hook without chain
[  255.072107] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher
[  255.122065] kernel msg: ebtables bug: please report to author: Valid hook without chain
[  255.125754]  dev_queue_xmit+0x17/0x20
[  255.125774]  ip_finish_output2+0xf4d/0x1550
[  255.156703] sctp: [Deprecated]: syz-executor4 (pid 21390) Use of int in maxseg socket option.
[  255.156703] Use struct sctp_assoc_value instead
[  255.158201]  ip_finish_output+0x864/0xd60
[  255.175664] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher
[  255.180547]  ip_mc_output+0x271/0x1350
[  255.286554]  ip_local_out+0x95/0x160
[  255.290313]  iptunnel_xmit+0x556/0x810
[  255.294200]  ip_tunnel_xmit+0x16fc/0x3550
[  255.327878]  __gre_xmit+0x546/0x8b0
[  255.331484]  gre_tap_xmit+0x2b7/0x510
[  255.339313]  dev_hard_start_xmit+0x24e/0xac0
[  255.388324]  sch_direct_xmit+0x40d/0x1140
[  255.406209]  __qdisc_run+0x676/0x19b0
[  255.435916]  __dev_queue_xmit+0xb8b/0x2fd0
[  255.517563]  dev_queue_xmit+0x17/0x20
[  255.525282]  br_dev_queue_push_xmit+0x196/0x5a0
[  255.533785]  br_forward_finish+0xc8/0x530
[  255.559302]  __br_forward+0x533/0xc80
[  255.583930]  deliver_clone+0x63/0xc0
[  255.587624]  br_flood+0x612/0x770
[  255.598888]  br_dev_xmit+0xa68/0x1550
[  255.643297]  dev_hard_start_xmit+0x24e/0xac0
[  255.691004]  __dev_queue_xmit+0x26cf/0x2fd0
[  255.803518]  dev_queue_xmit+0x17/0x20
[  255.811240]  ip_finish_output2+0xf4d/0x1550
[  255.840707]  ip_finish_output+0x864/0xd60
[  255.875583]  ip_mc_output+0x271/0x1350
[  255.931605]  ip_local_out+0x95/0x160
[  255.935291]  iptunnel_xmit+0x556/0x810
[  255.939156]  ip_tunnel_xmit+0x16fc/0x3550
[  255.982190]  __gre_xmit+0x546/0x8b0
[  255.985794]  erspan_xmit+0x779/0x22b0
[  256.011824]  dev_hard_start_xmit+0x24e/0xac0
[  256.067671]  sch_direct_xmit+0x40d/0x1140
[  256.085543]  __qdisc_run+0x676/0x19b0
[  256.115185]  __dev_queue_xmit+0xb8b/0x2fd0
[  256.343177]  dev_queue_xmit+0x17/0x20
[  256.350892]  br_dev_queue_push_xmit+0x196/0x5a0
[  256.359665]  br_nf_dev_queue_xmit+0x2f1/0x1690
[  256.395673]  br_nf_post_routing+0xc56/0x1570
[  256.439088]  nf_hook_slow+0xba/0x1a0
[  256.442776]  br_forward_finish+0x34a/0x530
[  256.460132]  br_nf_hook_thresh+0x406/0x560
[  256.485897]  br_nf_forward_finish+0x313/0x670
[  256.495182]  br_nf_forward_ip+0xcee/0x1ae0
[  256.575146]  nf_hook_slow+0xba/0x1a0
[  256.578835]  __br_forward+0x49c/0xc80
[  256.603388]  deliver_clone+0x63/0xc0
[  256.607076]  br_flood+0x5c6/0x770
[  256.622791]  br_handle_frame_finish+0x5e3/0x15e0
[  256.668972]  br_nf_hook_thresh+0x406/0x560
[  256.686593]  br_nf_pre_routing_finish+0x87b/0x18e0
[  256.730755]  br_nf_pre_routing+0xdbd/0x14b0
[  256.765565]  nf_hook_slow+0xba/0x1a0
[  256.769251]  br_handle_frame+0xb5b/0x1740
[  256.825444]  __netif_receive_skb_core+0x984/0x3480
[  256.916166]  __netif_receive_skb+0x2c/0x1b0
[  256.924931]  process_backlog+0x203/0x740
[  256.933172]  net_rx_action+0x788/0x1910
[  257.039896]  __do_softirq+0x2d7/0xb85
[  257.096312]  do_softirq_own_stack+0x2a/0x40
[  257.100602]  </IRQ>
[  257.102813]  do_softirq.part.19+0x14d/0x190
[  257.111577]  __local_bh_enable_ip+0x1ee/0x230
[  257.116048]  ip_finish_output2+0x962/0x1550
[  257.144200]  ip_finish_output+0x864/0xd60
[  257.179070]  ip_output+0x1d2/0x860
[  257.199540]  ip_local_out+0x95/0x160
[  257.203227]  ip_send_skb+0x3c/0xc0
[  257.206741]  ip_push_pending_frames+0x64/0x80
[  257.211210]  raw_sendmsg+0x1d4d/0x26b0
[  257.272778]  inet_sendmsg+0x11f/0x5e0
[  257.292972]  sock_sendmsg+0xca/0x110
[  257.296658]  __sys_sendto+0x365/0x5a0
[  257.335276]  SyS_sendto+0x40/0x60
[  257.342650]  do_syscall_64+0x281/0x940
[  257.384559]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[  257.389723] RIP: 0033:0x4552d9
[  257.392885] RSP: 002b:00007f4d152e6c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  257.400562] RAX: ffffffffffffffda RBX: 00007f4d152e76d4 RCX: 00000000004552d9
[  257.407802] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
[  257.415046] RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
[  257.422288] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[  257.429530] R13: 00000000000004f2 R14: 00000000006fa750 R15: 0000000000000000
[  257.437463] Dumping ftrace buffer:
[  257.441182]    (ftrace buffer empty)
[  257.444864] Kernel Offset: disabled
[  257.448463] Rebooting in 86400 seconds..

