BUG: TASK stack guard page was hit at ffffc9000011fff8 (stack is ffffc90000120000..ffffc90000128000)
Oops: stack guard page: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: bond7 bond_resend_igmp_join_requests_delayed
RIP: 0010:check_preemption_disabled+0x5/0x120
Code: 48 c7 c6 40 c6 bf 8b eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 <53> 48 83 ec 10 65 48 8b 05 1e 92 2d 07 48 89 44 24 08 65 8b 05 26
RSP: 0018:ffffc90000120000 EFLAGS: 00010087
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8bbfc640 RDI: ffffffff8bbfc600
RBP: ffffffff82199e59 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f00b4f R12: 0000000000000000
R13: ffff88823fff8918 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8882a9eb1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000011fff8 CR3: 000000017514a000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 rcu_is_watching+0x15/0xb0
 lock_acquire+0x5f/0x340
 _raw_spin_lock_irqsave+0xa7/0xf0
 get_page_from_freelist+0xaf9/0x2440
 __alloc_frozen_pages_noprof+0x181/0x370
 alloc_pages_mpol+0x232/0x4a0
 ___kmalloc_large_node+0x4e/0x100
 __kmalloc_large_node_noprof+0x18/0x90
 __kmalloc_node_track_caller_noprof+0x134/0x810
 kmalloc_reserve+0x136/0x290
 pskb_expand_head+0x19d/0x1160
 gre_tap_xmit+0x4d5/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip_finish_output2+0xd03/0x1160
 ip_output+0x29f/0x450
 iptunnel_xmit+0x5f8/0xa90
 ip_tunnel_xmit+0x1c41/0x2390
 gre_tap_xmit+0x590/0x7a0
 dev_hard_start_xmit+0x2cd/0x800
 sch_direct_xmit+0x241/0x4b0
 __dev_queue_xmit+0x136f/0x3140
 bond_dev_queue_xmit+0x10b/0x1e0
 bond_start_xmit+0x779/0x1a10
 dev_hard_start_xmit+0x2cd/0x800
 __dev_queue_xmit+0x1493/0x3140
 ip6_finish_output2+0xfb3/0x1480
 ip6_output+0x340/0x550
 NF_HOOK+0x9e/0x380
 mld_sendpack+0x8d4/0xe60
 ipv6_mc_netdev_event+0x1b7/0x5a0
 notifier_call_chain+0x19d/0x3a0
 call_netdevice_notifiers+0x88/0xc0
 bond_resend_igmp_join_requests_delayed+0x61/0x170
 process_scheduled_works+0xad1/0x1770
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x599/0xb30
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:check_preemption_disabled+0x5/0x120
Code: 48 c7 c6 40 c6 bf 8b eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 <53> 48 83 ec 10 65 48 8b 05 1e 92 2d 07 48 89 44 24 08 65 8b 05 26
RSP: 0018:ffffc90000120000 EFLAGS: 00010087
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8bbfc640 RDI: ffffffff8bbfc600
RBP: ffffffff82199e59 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f00b4f R12: 0000000000000000
R13: ffff88823fff8918 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8882a9eb1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000011fff8 CR3: 000000017514a000 CR4: 00000000000006f0
