erspan1: entered allmulticast mode bond0: (slave erspan1): making interface the new active one erspan1: entered promiscuous mode ============================================ WARNING: possible recursive locking detected syzkaller #0 Tainted: G L -------------------------------------------- syz.9.13272/18547 is trying to acquire lock: ffff888032cc0158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff888032cc0158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] ffff888032cc0158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x153/0x4b0 net/sched/sch_generic.c:345 but task is already holding lock: ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x153/0x4b0 net/sched/sch_generic.c:345 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&qdisc_xmit_lock_key#4); lock(&qdisc_xmit_lock_key#4); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by syz.9.13272/18547: #0: ffffffff8f83c838 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8f83c838 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8f83c838 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f312048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f312048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f312048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 net/core/rtnetlink.c:4071 #2: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #2: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] #2: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x289/0x31c0 net/core/dev.c:4744 #3: ffff888024d92228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #3: ffff888024d92228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:202 [inline] #3: ffff888024d92228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4156 [inline] #3: ffff888024d92228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_queue_xmit+0xeb9/0x31c0 net/core/dev.c:4785 #4: ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #4: ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] #4: ffff888058da3158 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x153/0x4b0 net/sched/sch_generic.c:345 #5: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #5: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 net/ipv4/ip_output.c:433 #6: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #6: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #6: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3d0/0x1000 net/ipv4/ip_output.c:230 #7: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #7: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #7: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 net/ipv4/arp.c:662 #8: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #8: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] #8: ffffffff8df41b00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x289/0x31c0 net/core/dev.c:4744 #9: ffff888031bac228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #9: ffff888031bac228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:202 [inline] #9: ffff888031bac228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4156 [inline] #9: ffff888031bac228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_queue_xmit+0xeb9/0x31c0 net/core/dev.c:4785 stack backtrace: CPU: 1 UID: 0 PID: 18547 Comm: syz.9.13272 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x2540/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4710 [inline] sch_direct_xmit+0x153/0x4b0 net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:4169 [inline] __dev_queue_xmit+0x1379/0x31c0 net/core/dev.c:4785 NF_HOOK+0x310/0x3a0 include/linux/netfilter.h:-1 arp_xmit+0x16c/0x270 net/ipv4/arp.c:664 arp_solicit+0xbbd/0xe10 net/ipv4/arp.c:392 neigh_probe net/core/neighbour.c:1097 [inline] __neigh_event_send+0xf3e/0x1520 net/core/neighbour.c:1270 neigh_event_send_probe include/net/neighbour.h:480 [inline] neigh_event_send include/net/neighbour.h:486 [inline] neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1578 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xbb6/0x1000 net/ipv4/ip_output.c:237 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 iptunnel_xmit+0x5f8/0xa90 net/ipv4/ip_tunnel_core.c:84 ip_tunnel_xmit+0x1c41/0x2390 net/ipv4/ip_tunnel.c:845 __gre_xmit+0x19a/0x240 net/ipv4/ip_gre.c:490 erspan_xmit+0xa04/0x1220 net/ipv4/ip_gre.c:749 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3853 [inline] dev_hard_start_xmit+0x2cd/0x800 net/core/dev.c:3869 sch_direct_xmit+0x241/0x4b0 net/sched/sch_generic.c:347 __dev_xmit_skb net/core/dev.c:4169 [inline] __dev_queue_xmit+0x1379/0x31c0 net/core/dev.c:4785 dev_queue_xmit include/linux/netdevice.h:3381 [inline] alb_send_lp_vid+0x328/0x530 drivers/net/bonding/bond_alb.c:949 alb_send_learning_packets+0x10d/0x2c0 drivers/net/bonding/bond_alb.c:1012 alb_fasten_mac_swap+0x639/0xf60 drivers/net/bonding/bond_alb.c:1076 bond_alb_handle_active_change+0xc10/0xec0 drivers/net/bonding/bond_alb.c:1774 bond_change_active_slave+0x1044/0x35e0 drivers/net/bonding/bond_main.c:1256 bond_select_active_slave+0x8d2/0xce0 drivers/net/bonding/bond_main.c:1336 bond_enslave+0x2341/0x3ac0 drivers/net/bonding/bond_main.c:2195 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 rtnl_newlink_create+0x677/0xb00 net/core/rtnetlink.c:3854 __rtnl_newlink net/core/rtnetlink.c:3957 [inline] rtnl_newlink+0x16e7/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf70bd539 Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f548c55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 bond0: (slave erspan1): Enslaving as an active interface with an up link syz.9.13272 (18547) used greatest stack depth: 16488 bytes left ---------------- Code disassembly (best guess): 0: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 4: 10 07 adc %al,(%rdi) 6: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi a: 10 08 adc %cl,(%rax) c: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop