syzbot


BUG: MAX_LOCK_DEPTH too low! (6)

Status: internal: reported on 2026/03/14 07:19
Subsystems: net
[Documentation on labels]
Fix commit: b7405dcf7385 bonding: prevent potential infinite loop in bond_header_parse()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-upstream-gce-arm64 ci2-upstream-usb]
First crash: 12d, last: 12d
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: MAX_LOCK_DEPTH too low! net -1 1 2886d 2886d 5/29 fixed on 2018/05/17 10:02
linux-6.6 BUG: MAX_LOCK_DEPTH too low! origin:lts-only -1 C done 5 122d 173d 0/2 upstream: reported C repro on 2025/10/04 16:06
upstream BUG: MAX_LOCK_DEPTH too low! (3) smc -1 C done 18 1498d 1507d 22/29 fixed on 2023/02/24 13:50
upstream BUG: MAX_LOCK_DEPTH too low! (5) btrfs -1 C 12 161d 501d 0/29 auto-obsoleted due to no activity on 2026/01/24 05:53
upstream BUG: MAX_LOCK_DEPTH too low! (2) net -1 C done 5 2814d 2844d 13/29 fixed on 2019/11/11 16:48
upstream BUG: MAX_LOCK_DEPTH too low! (4) fs -1 C error 1364 591d 687d 27/29 fixed on 2024/08/25 15:26

Sample crash report:
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48  max: 48!
48 locks held by kworker/u8:5/28866:
 #0: ffff888031e49148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff888031e49148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc90004ad7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc90004ad7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8fbc6f08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8fbc6f08 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 net/ipv6/addrconf.c:4198
 #3: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #3: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #3: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x215/0x1670 net/ipv6/ndisc.c:482
 #4: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #4: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #4: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x126/0x550 net/ipv6/ip6_output.c:234
 #5: ffffffff8e75e480 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #5: ffffffff8e75e480 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline]
 #5: ffffffff8e75e480 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x28d/0x38d0 net/core/dev.c:4762
 #6: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #6: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #6: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: dev_queue_xmit_nit+0x2d/0xad0 net/core/dev.c:2555
 #7: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #7: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #7: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #8: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #8: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #8: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #9: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #9: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #9: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #10: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #10: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #10: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #11: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #11: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #11: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #12: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #12: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #12: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #13: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #13: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #13: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #14: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #14: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #14: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #15: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #15: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #15: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #16: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #16: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #16: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #17: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #17: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #17: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #18: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #18: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #18: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #19: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #19: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #19: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #20: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #20: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #20: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #21: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #21: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #21: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #22: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #22: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #22: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #23: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #23: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #23: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #24: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #24: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #24: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #25: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #25: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #25: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #26: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #26: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #26: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #27: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #27: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #27: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #28: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #28: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #28: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #29: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #29: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #29: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #30: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #30: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #30: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #31: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #31: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #31: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #32: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #32: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #32: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #33: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #33: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #33: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #34: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #34: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #34: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #35: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #35: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #35: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #36: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #36: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #36: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #37: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #37: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #37: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #38: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #38: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #38: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #39: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #39: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #39: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #40: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #40: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #40: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #41: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #41: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #41: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #42: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #42: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #42: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #43: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #43: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #43: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #44: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #44: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #44: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #45: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #45: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #45: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #46: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #46: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #46: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
 #47: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #47: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #47: ffffffff8e75e420 (rcu_read_lock){....}-{1:3}, at: bond_header_parse+0x4c/0x2e0 drivers/net/bonding/bond_main.c:1540
INFO: lockdep is turned off.
CPU: 1 UID: 0 PID: 28866 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __lock_acquire+0x25e6/0x2cf0 kernel/locking/lockdep.c:5260
 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
 rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 bond_header_parse+0x68/0x2e0 drivers/net/bonding/bond_main.c:1540
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 bond_header_parse+0x1b8/0x2e0 drivers/net/bonding/bond_main.c:1545
 dev_parse_header include/linux/netdevice.h:3449 [inline]
 packet_rcv+0x9ca/0x1720 net/packet/af_packet.c:2186
 dev_queue_xmit_nit+0xa39/0xad0 net/core/dev.c:2607
 xmit_one net/core/dev.c:3868 [inline]
 dev_hard_start_xmit+0x1cf/0x870 net/core/dev.c:3888
 __dev_queue_xmit+0x17a7/0x38d0 net/core/dev.c:4838
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
 dst_output include/net/dst.h:470 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ndisc_send_skb+0xd0b/0x1670 net/ipv6/ndisc.c:512
 addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4364
 addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/14 07:18 net-next 9089c5f3c444 ee8d34d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce BUG: MAX_LOCK_DEPTH too low!
* Struck through repros no longer work on HEAD.