bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_1: entered allmulticast mode bridge_slave_1: entered promiscuous mode ============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz-executor/21399 is trying to acquire lock: ffffc90000ba60d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:423 but task is already holding lock: ffffc900038390d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:423 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rb->spinlock); lock(&rb->spinlock); *** DEADLOCK *** May be due to missing lock nesting notation 5 locks held by syz-executor/21399: #0: ffffffff8dfbc908 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8dfbc908 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6472 #1: ffffffff8e324cc8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_env+0x4f3/0x8c0 lib/kobject_uevent.c:601 #2: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #2: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #2: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2321 [inline] #2: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run3+0xf4/0x400 kernel/trace/bpf_trace.c:2362 #3: ffffc900038390d8 (&rb->spinlock){-.-.}-{2:2}, at: __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:423 #4: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #4: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #4: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2321 [inline] #4: ffffffff8cd2fe20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0xde/0x3c0 kernel/trace/bpf_trace.c:2361 stack backtrace: CPU: 1 PID: 21399 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 check_deadlock kernel/locking/lockdep.c:3062 [inline] validate_chain kernel/locking/lockdep.c:3856 [inline] __lock_acquire+0x5d40/0x7c80 kernel/locking/lockdep.c:5137 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa8/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:423 ____bpf_ringbuf_output kernel/bpf/ringbuf.c:549 [inline] bpf_ringbuf_output+0x69/0x1e0 kernel/bpf/ringbuf.c:539 bpf_prog_fab844a31c87a330+0x4d/0x51 bpf_dispatcher_nop_func include/linux/bpf.h:1223 [inline] __bpf_prog_run include/linux/filter.h:612 [inline] bpf_prog_run include/linux/filter.h:619 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2322 [inline] bpf_trace_run2+0x1d1/0x3c0 kernel/trace/bpf_trace.c:2361 __bpf_trace_contention_end+0xdd/0x130 include/trace/events/lock.h:122 trace_contention_end+0xe6/0x110 include/trace/events/lock.h:122 __pv_queued_spin_lock_slowpath+0x7ec/0x9d0 kernel/locking/qspinlock.c:560 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:586 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x24e/0x2c0 kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline] _raw_spin_lock_irqsave+0xb4/0xf0 kernel/locking/spinlock.c:162 __bpf_ringbuf_reserve+0x1c8/0x5a0 kernel/bpf/ringbuf.c:423 ____bpf_ringbuf_reserve kernel/bpf/ringbuf.c:474 [inline] bpf_ringbuf_reserve+0x5c/0x70 kernel/bpf/ringbuf.c:466 bpf_prog_fe0ed97373b08409+0x2d/0x4a bpf_dispatcher_nop_func include/linux/bpf.h:1223 [inline] __bpf_prog_run include/linux/filter.h:612 [inline] bpf_prog_run include/linux/filter.h:619 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2322 [inline] bpf_trace_run3+0x1e7/0x400 kernel/trace/bpf_trace.c:2362 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x1e0/0x280 mm/slub.c:3851 netlink_broadcast_filtered+0x101c/0x1110 net/netlink/af_netlink.c:1538 netlink_broadcast+0x37/0x50 net/netlink/af_netlink.c:1560 uevent_net_broadcast_tagged lib/kobject_uevent.c:372 [inline] kobject_uevent_net_broadcast+0x497/0x530 lib/kobject_uevent.c:412 kobject_uevent_env+0x550/0x8c0 lib/kobject_uevent.c:608 __kobject_del+0xd2/0x300 lib/kobject.c:601 kobject_cleanup lib/kobject.c:680 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x239/0x470 lib/kobject.c:737 netdev_queue_update_kobjects+0x3ed/0x480 net/core/net-sysfs.c:1760 netif_set_real_num_tx_queues+0x183/0x8e0 net/core/dev.c:2969 veth_init_queues+0x83/0x180 drivers/net/veth.c:1797 veth_newlink+0x9a9/0xc30 drivers/net/veth.c:1920 rtnl_newlink_create net/core/rtnetlink.c:3517 [inline] __rtnl_newlink net/core/rtnetlink.c:3737 [inline] rtnl_newlink+0x14d0/0x2020 net/core/rtnetlink.c:3750 rtnetlink_rcv_msg+0x7c7/0xf10 net/core/rtnetlink.c:6475 netlink_rcv_skb+0x216/0x480 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x46a/0x620 net/socket.c:2201 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0xf0 net/socket.c:2209 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f88e2b90a3c Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b RSP: 002b:00007ffe2e1bd340 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f88e3904620 RCX: 00007f88e2b90a3c RDX: 0000000000000068 RSI: 00007f88e3904670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffe2e1bd394 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f88e3904670 R15: 0000000000000000 bond0: (slave bond_slave_0): Enslaving as an active interface with an up link bond0: (slave bond_slave_1): Enslaving as an active interface with an up link