bond3: (slave erspan1): making interface the new active one device erspan1 entered promiscuous mode ============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.2.3041/16943 is trying to acquire lock: ffff88807b9798d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88807b9798d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] ffff88807b9798d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4a0 net/sched/sch_generic.c:343 but task is already holding lock: ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4a0 net/sched/sch_generic.c:343 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&qdisc_xmit_lock_key#3); lock(&qdisc_xmit_lock_key#3); *** DEADLOCK *** May be due to missing lock nesting notation 9 locks held by syz.2.3041/16943: #0: ffffffff8dd494e8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd494e8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6155 #1: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #1: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline] #1: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 net/core/dev.c:4294 #2: ffff888077792258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #2: ffff888077792258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #2: ffff888077792258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3919 [inline] #2: ffff888077792258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0x131c/0x3810 net/core/dev.c:4337 #3: ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #3: ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] #3: ffff888078e244d8 (&qdisc_xmit_lock_key#3){+.-.}-{2:2}, at: sch_direct_xmit+0x162/0x4a0 net/sched/sch_generic.c:343 #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: ip_output+0x57/0x400 net/ipv4/ip_output.c:426 #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x407/0x1220 net/ipv4/ip_output.c:221 #6: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #6: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #6: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: arp_xmit+0x1f/0x260 net/ipv4/arp.c:662 #7: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #7: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline] #7: ffffffff8cb2dbc0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 net/core/dev.c:4294 #8: ffff888079d25258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #8: ffff888079d25258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #8: ffff888079d25258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3919 [inline] #8: ffff888079d25258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0x131c/0x3810 net/core/dev.c:4337 stack backtrace: CPU: 0 PID: 16943 Comm: syz.2.3041 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __lock_acquire+0x124e/0x7bd0 kernel/locking/lockdep.c:-1 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5662 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4345 [inline] sch_direct_xmit+0x162/0x4a0 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3932 [inline] __dev_queue_xmit+0x180d/0x3810 net/core/dev.c:4337 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:-1 arp_xmit+0x168/0x260 net/ipv4/arp.c:664 arp_solicit+0xbef/0xe10 net/ipv4/arp.c:392 neigh_probe net/core/neighbour.c:1080 [inline] __neigh_event_send+0xf6f/0x1610 net/core/neighbour.c:1247 neigh_event_send_probe include/net/neighbour.h:469 [inline] neigh_event_send include/net/neighbour.h:475 [inline] neigh_resolve_output+0x1a0/0x700 net/core/neighbour.c:1552 neigh_output include/net/neighbour.h:545 [inline] ip_finish_output2+0xd53/0x1220 net/ipv4/ip_output.c:228 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0x2d9/0x400 net/ipv4/ip_output.c:434 iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1d6a/0x25d0 net/ipv4/ip_tunnel.c:844 __gre_xmit net/ipv4/ip_gre.c:474 [inline] erspan_xmit+0x994/0x1550 net/ipv4/ip_gre.c:723 __netdev_start_xmit include/linux/netdevice.h:4894 [inline] netdev_start_xmit include/linux/netdevice.h:4908 [inline] xmit_one net/core/dev.c:3695 [inline] dev_hard_start_xmit+0x292/0x8b0 net/core/dev.c:3711 sch_direct_xmit+0x24d/0x4a0 net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:3932 [inline] __dev_queue_xmit+0x180d/0x3810 net/core/dev.c:4337 alb_send_learning_packets+0x129/0x300 drivers/net/bonding/bond_alb.c:1012 alb_fasten_mac_swap+0x484/0xf70 drivers/net/bonding/bond_alb.c:1076 bond_alb_handle_active_change+0xde6/0x1140 drivers/net/bonding/bond_alb.c:1776 bond_change_active_slave+0x10b0/0x3850 drivers/net/bonding/bond_main.c:1241 bond_select_active_slave+0x8ab/0xcd0 drivers/net/bonding/bond_main.c:1321 bond_enslave+0x2125/0x3820 drivers/net/bonding/bond_main.c:2268 do_set_master net/core/rtnetlink.c:2634 [inline] rtnl_newlink_create net/core/rtnetlink.c:3445 [inline] __rtnl_newlink net/core/rtnetlink.c:3648 [inline] rtnl_newlink+0x1ac4/0x1f90 net/core/rtnetlink.c:3661 rtnetlink_rcv_msg+0x863/0xfb0 net/core/rtnetlink.c:6158 netlink_rcv_skb+0x1ef/0x440 net/netlink/af_netlink.c:2516 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x7ad/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1877 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5ed/0x9a0 net/socket.c:2519 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2573 __sys_sendmsg net/socket.c:2602 [inline] __do_sys_sendmsg net/socket.c:2611 [inline] __se_sys_sendmsg+0x1c3/0x2b0 net/socket.c:2609 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff47c79ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff47d5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff47ca16090 RCX: 00007ff47c79ce59 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007ff47c832e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff47ca16128 R14: 00007ff47ca16090 R15: 00007ffe9c69cb18 bond3: (slave erspan1): Enslaving as an active interface with an up link syz.2.3041 (16943) used greatest stack depth: 17072 bytes left