bond11: (slave erspan1): making interface the new active one device erspan1 entered promiscuous mode ============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.5.3648/18445 is trying to acquire lock: ffff88807758a398 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline] ffff88807758a398 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4446 [inline] ffff88807758a398 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4b0 net/sched/sch_generic.c:343 but task is already holding lock: ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline] ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4446 [inline] ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4b0 net/sched/sch_generic.c:343 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_ETHER#2); lock(_xmit_ETHER#2); *** DEADLOCK *** May be due to missing lock nesting notation 11 locks held by syz.5.3648/18445: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 #1: ffffffff8c31f380 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 #2: ffff888047ed9258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:374 [inline] #2: ffff888047ed9258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:173 [inline] #2: ffff888047ed9258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3884 [inline] #2: ffff888047ed9258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1120/0x2f80 net/core/dev.c:4266 #3: ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline] #3: ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4446 [inline] #3: ffff88807c52fc98 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4b0 net/sched/sch_generic.c:343 #4: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 #5: ffffffff8c31f380 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 #6: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312 #7: ffffffff8c31f380 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 #8: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312 #9: ffffffff8c31f380 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 #10: ffff88801ec4e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:374 [inline] #10: ffff88801ec4e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:173 [inline] #10: ffff88801ec4e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3884 [inline] #10: ffff88801ec4e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1120/0x2f80 net/core/dev.c:4266 stack backtrace: CPU: 0 PID: 18445 Comm: syz.5.3648 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 __lock_acquire+0x1236/0x7d10 kernel/locking/lockdep.c:-1 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:364 [inline] __netif_tx_lock include/linux/netdevice.h:4446 [inline] sch_direct_xmit+0x162/0x4b0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3897 [inline] __dev_queue_xmit+0x179f/0x2f80 net/core/dev.c:4266 __bond_start_xmit drivers/net/bonding/bond_main.c:-1 [inline] bond_start_xmit+0x1230/0x1ad0 drivers/net/bonding/bond_main.c:5180 __netdev_start_xmit include/linux/netdevice.h:5036 [inline] netdev_start_xmit include/linux/netdevice.h:5050 [inline] xmit_one net/core/dev.c:3662 [inline] dev_hard_start_xmit+0x2a5/0x7e0 net/core/dev.c:3678 __dev_queue_xmit+0x1a9b/0x2f80 net/core/dev.c:4305 NF_HOOK+0x2fe/0x380 include/linux/netfilter.h:302 arp_xmit+0x142/0x230 net/ipv4/arp.c:643 arp_solicit+0xba5/0xde0 net/ipv4/arp.c:391 neigh_probe net/core/neighbour.c:1017 [inline] __neigh_event_send+0xede/0x1470 net/core/neighbour.c:1178 neigh_event_send include/net/neighbour.h:438 [inline] neigh_resolve_output+0x1b3/0x6a0 net/core/neighbour.c:1488 neigh_output include/net/neighbour.h:509 [inline] ip_finish_output2+0xcbf/0x10a0 net/ipv4/ip_output.c:228 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0x2c0/0x3e0 net/ipv4/ip_output.c:434 iptunnel_xmit+0x4d6/0x8e0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1905/0x2280 net/ipv4/ip_tunnel.c:824 __gre_xmit net/ipv4/ip_gre.c:474 [inline] erspan_xmit+0x9d5/0x15a0 net/ipv4/ip_gre.c:723 __netdev_start_xmit include/linux/netdevice.h:5036 [inline] netdev_start_xmit include/linux/netdevice.h:5050 [inline] xmit_one net/core/dev.c:3662 [inline] dev_hard_start_xmit+0x2a5/0x7e0 net/core/dev.c:3678 sch_direct_xmit+0x25a/0x4b0 net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:3897 [inline] __dev_queue_xmit+0x179f/0x2f80 net/core/dev.c:4266 alb_send_learning_packets+0x125/0x2d0 drivers/net/bonding/bond_alb.c:1000 alb_fasten_mac_swap+0x650/0xf80 drivers/net/bonding/bond_alb.c:1064 bond_alb_handle_active_change+0x9f8/0x1170 drivers/net/bonding/bond_alb.c:1741 bond_change_active_slave+0x1038/0x3610 drivers/net/bonding/bond_main.c:1164 bond_select_active_slave+0x67f/0xa80 drivers/net/bonding/bond_main.c:1244 bond_enslave+0x2214/0x3c50 drivers/net/bonding/bond_main.c:2178 do_set_master+0x120/0x220 net/core/rtnetlink.c:2580 __rtnl_newlink net/core/rtnetlink.c:3546 [inline] rtnl_newlink+0x1757/0x1a50 net/core/rtnetlink.c:3577 rtnetlink_rcv_msg+0x844/0xf30 net/core/rtnetlink.c:5687 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] ____sys_sendmsg+0x5b7/0x8f0 net/socket.c:2445 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2499 __sys_sendmsg net/socket.c:2528 [inline] __do_sys_sendmsg net/socket.c:2537 [inline] __se_sys_sendmsg+0x1af/0x290 net/socket.c:2535 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc3da209e59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc3d8442028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fc3da483090 RCX: 00007fc3da209e59 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007fc3da29fd6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc3da483128 R14: 00007fc3da483090 R15: 00007ffefcd313c8 bond11: (slave erspan1): Enslaving as an active interface with an up link syz.5.3648 (18445) used greatest stack depth: 16080 bytes left