Description of problem:
I hit kernel bug while shutting down bonded interface with vlan tag.
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at net/core/skbuff.c:112
invalid opcode: 0000 [1] SMP 
last sysfs file: /class/net/bond0/bonding/slaves
CPU 0 
Modules linked in: sctp nfsd exportfs nfs_acl auth_rpcgss autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc bonding be2iscsi ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp bnx2i cnic ipv6 xfrm_nalgo crypto_api uio cxgb3i libcxgbi cxgb3 8021q libiscsi_tcp libiscsi2 scsi_transport_iscsi2 scsi_transport_iscsi dm_multipath scsi_dh video backlight sbs power_meter hwmon i2c_ec dell_wmi wmi button battery asus_acpi acpi_memhotplug ac parport_pc lp parport floppy virtio_balloon virtio_net i2c_piix4 i2c_core tpm_tis tpm serio_raw tpm_bios pcspkr dm_raid45 dm_message dm_region_hash dm_mem_cache dm_snapshot dm_zero dm_mirror dm_log dm_mod ata_piix libata sd_mod scsi_mod virtio_blk virtio_pci virtio_ring virtio ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 11180, comm: ifdown-eth Not tainted 2.6.18-330.el5 #1
RIP: 0010:[<ffffffff8023471a>]  [<ffffffff8023471a>] skb_under_panic+0x4d/0x5d
RSP: 0018:ffff81002d51fb98  EFLAGS: 00010286
RAX: 0000000000000098 RBX: ffff81003e43e680 RCX: 0000000000000286
RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff8032405c
RBP: 00000000000086dd R08: 000000000000000d R09: 0000000000000010
R10: 0000000000000001 R11: 0000000000000010 R12: 0000000000000000
R13: ffff81003d134000 R14: ffff81003a3689c4 R15: 000000000000004c
FS:  00002b808ae05f50(0000) GS:ffffffff80432000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002b808e3df000 CR3: 000000002d583000 CR4: 00000000000006e0
Process ifdown-eth (pid: 11180, threadinfo ffff81002d51e000, task ffff81002e301080)
Stack:  ffff81002fd2b058 ffff81002fd2b100 ffff81003d134000 0000000000000004
 ffff81002d51fc60 ffffffff8005ad7d ffffffff883fd68a ffff81002e067a40
 ffff81003a368980 ffff81003e43e680 ffff81003d4d0940 ffff81003d13dd86
Call Trace:
 [<ffffffff8005ad7d>] eth_header+0x4f/0xd8
 [<ffffffff883fd68a>] :ipv6:ip6_output_finish+0x0/0xf8
 [<ffffffff80057118>] neigh_resolve_output+0x1ab/0x252
 [<ffffffff883fdafb>] :ipv6:ip6_output2+0x2df/0x33d
 [<ffffffff8027fc9c>] xfrm_lookup+0xe/0x5f
 [<ffffffff884105c7>] :ipv6:ndisc_send_skb+0x1d3/0x2ff
 [<ffffffff8855689d>] :bonding:bond_na_send+0x1f5/0x202
 [<ffffffff885569ab>] :bonding:bond_send_unsolicited_na+0x101/0x11e
 [<ffffffff8854c8b2>] :bonding:bond_change_active_slave+0x438/0x4bc
 [<ffffffff8854c5d8>] :bonding:bond_change_active_slave+0x15e/0x4bc
 [<ffffffff8854ccca>] :bonding:bond_select_active_slave+0xc9/0xf7
 [<ffffffff8854cf00>] :bonding:bond_release+0x208/0x45d
 [<ffffffff8006458b>] __down_write_nested+0x12/0x92
 [<ffffffff88555dae>] :bonding:bonding_store_slaves+0x25c/0x2f7
 [<ffffffff80112c93>] sysfs_write_file+0xb9/0xe8
 [<ffffffff80016b44>] vfs_write+0xce/0x174
 [<ffffffff8001740d>] sys_write+0x45/0x6e
 [<ffffffff8005d28d>] tracesys+0xd5/0xe0


Code: 0f 0b 68 d4 a3 2e 80 c2 70 00 48 83 c4 20 eb fe 48 83 ec 10 
RIP  [<ffffffff8023471a>] skb_under_panic+0x4d/0x5d
 RSP <ffff81002d51fb98>
Linux version 2.6.18-330.el5 (mockbuild.bos.redhat.com) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Wed Jul 18 11:18:55 EDT 2012



Version-Release number of selected component (if applicable):
kernel-2.6.18-330.el5

How reproducible:
100%

Steps to Reproduce:
1. setup bonded interface
2. vconfig add bond0 5
3. ifdown bond0
4. ifup bond0
5. ifdown bond0 (this triggers the bug)

To trigger this 'service network restart' can also be used instead of ifdown/up.
  
Actual results:
kernel bug is triggered

Expected results:
no kernel bug, error message if the operation is not permitted

Additional info:
All eth are virtio nics inside of rhel5 VM hosted on rhel6 host.

$ cat /proc/net/bonding/bond0 
Ethernet Channel Bonding Driver: v3.4.0-1 (October 7, 2008)

Bonding Mode: fault-tolerance (active-backup)
Primary Slave: None
Currently Active Slave: eth1
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 200
Down Delay (ms): 200

Slave Interface: eth1
MII Status: up
Speed: Unknown
Duplex: Unknown
Link Failure Count: 0
Permanent HW addr: 52:54:00:01:01:01

Slave Interface: eth3
MII Status: up
Speed: Unknown
Duplex: Unknown
Link Failure Count: 0
Permanent HW addr: 52:54:00:01:01:a1