bond1: (slave gre1): Setting fail_over_mac to active for active-backup mode
bond1: (slave gre1): making interface the new active one
device gre1 entered promiscuous mode
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:1840!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5314 Comm: syz.1.297 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : pskb_expand_head+0xff4/0x1050 net/core/skbuff.c:1840
lr : pskb_expand_head+0xff4/0x1050 net/core/skbuff.c:1840
sp : ffff8000210b6640
x29: ffff8000210b6680 x28: 1fffe0001a8d72e1 x27: dfff800000000000
x26: ffff0000d46b970c x25: 00000000000000c0 x24: ffff0000ec37c840
x23: 0000000000000000 x22: 0000000000000a20 x21: 98e48000107f49d0
x20: 00000000ffff7fe0 x19: ffff0000d46b9640 x18: 1fffe00033e6df7e
x17: ffff80001539d000 x16: ffff800011ba0e90 x15: ffff80000fe7f25c
x14: 0000000000000001 x13: 1fffe0001d86f91c x12: 0000000000080000
x11: 000000000007ffff x10: ffff800022609000 x9 : ffff80000feae2ac
x8 : 0000000000080000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000018 x4 : ffff0000cd54eb28 x3 : 0000000000000a20
x2 : 0000000000000000 x1 : 00000000ffff7fe0 x0 : 0000000000000000
Call trace:
 pskb_expand_head+0xff4/0x1050 net/core/skbuff.c:1840
 ipgre_header+0xdc/0x4b8 net/ipv4/ip_gre.c:863
 dev_hard_header include/linux/netdevice.h:3105 [inline]
 arp_create+0x2bc/0x81c net/ipv4/arp.c:577
 arp_send_dst net/ipv4/arp.c:314 [inline]
 arp_send+0xa4/0x114 net/ipv4/arp.c:328
 inetdev_send_gratuitous_arp net/ipv4/devinet.c:1528 [inline]
 inetdev_event+0xda8/0x12dc net/ipv4/devinet.c:1598
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers+0x110/0x198 net/core/dev.c:2066
 bond_change_active_slave+0x1f48/0x2f1c drivers/net/bonding/bond_main.c:-1
 bond_select_active_slave+0x7b0/0xa9c drivers/net/bonding/bond_main.c:1321
 bond_enslave+0x1a6c/0x2d58 drivers/net/bonding/bond_main.c:2268
 do_set_master net/core/rtnetlink.c:2642 [inline]
 rtnl_newlink_create net/core/rtnetlink.c:3453 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3656 [inline]
 rtnl_newlink+0x16f4/0x1af0 net/core/rtnetlink.c:3669
 rtnetlink_rcv_msg+0x694/0xcc4 net/core/rtnetlink.c:6166
 netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6184
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x588/0x90c net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1803e0 96246fba d4210000 961812a6 (d4210000) 
---[ end trace 0000000000000000 ]---