BUG: TASK stack guard page was hit at ffffc9000de7ffc8 (stack is ffffc9000de80000..ffffc9000de88000) Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 3876 Comm: kworker/u8:7 Not tainted 6.14.0-rc6-syzkaller-00121-gd9c743b6990b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: bond10 bond_alb_monitor RIP: 0010:__lock_acquire+0x11/0x2100 kernel/locking/lockdep.c:5079 Code: e8 f4 4c 8c 00 eb 84 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 48 81 ec 90 00 00 00 <44> 89 4c 24 28 44 89 c5 89 cb 41 89 f5 49 89 ff 65 4c 8b 24 25 80 RSP: 0018:ffffc9000de7ffd0 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffffc9000de80120 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8eb39440 RBP: ffffc9000de80208 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff2079f4f R12: 1ffff92001bd0020 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000de7ffc8 CR3: 000000006d162000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock_bh include/linux/rcupdate.h:903 [inline] __dev_queue_xmit+0x325/0x3f50 net/core/dev.c:4577 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] bond_dev_queue_xmit+0x147/0x250 drivers/net/bonding/bond_main.c:309 __bond_start_xmit drivers/net/bonding/bond_main.c:5583 [inline] bond_start_xmit+0xcb0/0x1c40 drivers/net/bonding/bond_main.c:5605 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4652 dev_queue_xmit include/linux/netdevice.h:3313 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xcd3/0x12e0 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbf/0x2560 net/ipv4/ip_tunnel.c:858 __gre_xmit net/ipv4/ip_gre.c:484 [inline] gre_tap_xmit+0x641/0x800 net/ipv4/ip_gre.c:772 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3816 sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4042 [inline] __dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4618 dev_queue_xmit include/linux/netdevice.h:3313 [inline] alb_send_lp_vid+0x3b1/0x650 drivers/net/bonding/bond_alb.c:949 alb_send_learning_packets+0x19b/0x380 drivers/net/bonding/bond_alb.c:1012 bond_alb_monitor+0x3f3/0x1750 drivers/net/bonding/bond_alb.c:1564 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319 worker_thread+0x870/0xd30 kernel/workqueue.c:3400 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__lock_acquire+0x11/0x2100 kernel/locking/lockdep.c:5079 Code: e8 f4 4c 8c 00 eb 84 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 48 81 ec 90 00 00 00 <44> 89 4c 24 28 44 89 c5 89 cb 41 89 f5 49 89 ff 65 4c 8b 24 25 80 RSP: 0018:ffffc9000de7ffd0 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffffc9000de80120 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8eb39440 RBP: ffffc9000de80208 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff2079f4f R12: 1ffff92001bd0020 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000de7ffc8 CR3: 000000006d162000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: e8 f4 4c 8c 00 call 0x8c4cf9 5: eb 84 jmp 0xffffff8b 7: 66 90 xchg %ax,%ax 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 55 push %rbp 1a: 41 57 push %r15 1c: 41 56 push %r14 1e: 41 55 push %r13 20: 41 54 push %r12 22: 53 push %rbx 23: 48 81 ec 90 00 00 00 sub $0x90,%rsp * 2a: 44 89 4c 24 28 mov %r9d,0x28(%rsp) <-- trapping instruction 2f: 44 89 c5 mov %r8d,%ebp 32: 89 cb mov %ecx,%ebx 34: 41 89 f5 mov %esi,%r13d 37: 49 89 ff mov %rdi,%r15 3a: 65 gs 3b: 4c rex.WR 3c: 8b .byte 0x8b 3d: 24 25 and $0x25,%al 3f: 80 .byte 0x80