2026-03-10, 10:02:09 -0700, syzbot ci wrote:
> batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later):
> interface not active
> hsr_slave_0: entered promiscuous mode
> hsr_slave_1: entered promiscuous mode
> ------------[ cut here ]------------
> err == -EMSGSIZE
> WARNING: net/core/rtnetlink.c:4421 at rtmsg_ifinfo_build_skb+0x218/0x260,
> CPU#0: syz-executor/6496
I'm not sure this one is caused by this series, but either way,
reviewing if_nlmsg_size/rtnl_fill_ifinfo for mismatches is really
unpleasant :/
Things I see in rtnl_fill_ifinfo but don't find in if_nlmsg_size:
- IFLA_PARENT_DEV_NAME
- IFLA_PARENT_DEV_BUS_NAME
(both from 00e77ed8e64d ("rtnetlink: add
IFLA_PARENT_[DEV|DEV_BUS]_NAME"), which doesn't include a change to
if_nlmsg_size)
- rtnl_link_slave_info_fill also outputs IFLA_INFO_SLAVE_KIND + the
IFLA_INFO_SLAVE_DATA nest, but rtnl_link_get_slave_info_data_size
only counts the nest, and its caller (rtnl_link_get_size) doesn't
have anything more about the slave info. This may be what syzbot is
tripping on here.
But there's a
+ nla_total_size(4) /* IFLA_WEIGHT */
that doesn't get filled anywhere.
> Modules linked in:
> CPU: 0 UID: 0 PID: 6496 Comm: syz-executor Not tainted syzkaller #0
> PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> 1.16.2-debian-1.16.2-1 04/01/2014
> RIP: 0010:rtmsg_ifinfo_build_skb+0x218/0x260
> Code: f6 ba 01 00 00 00 89 e9 e8 25 15 3a 00 4c 89 f0 48 83 c4 30 5b 41 5c 41
> 5d 41 5e 41 5f 5d e9 7f 3a 2e 02 cc e8 49 3b 42 f8 90 <0f> 0b 90 eb 90 89 d9
> 80 e1 07 fe c1 38 c1 0f 8c 95 fe ff ff 48 89
> RSP: 0018:ffffc9000637e9a0 EFLAGS: 00010293
> RAX: ffffffff89835e27 RBX: 0000000000000000 RCX: ffff8881b80a57c0
> RDX: 0000000000000000 RSI: 00000000ffffffa6 RDI: 00000000ffffffa6
> RBP: 00000000ffffffa6 R08: 0000000000000004 R09: 0000000000000004
> R10: fffff52000c6fcdc R11: 0000000000000000 R12: 1ffff110235ddc21
> R13: 0000000000000000 R14: ffff8881133dc780 R15: ffff88811aeee000
> FS: 0000555557c4a500(0000) GS:ffff88818de65000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055555e1838c8 CR3: 0000000168b80000 CR4: 00000000000006f0
> Call Trace:
> <TASK>
> rtnetlink_event+0x1b7/0x270
> notifier_call_chain+0x1be/0x400
> netdev_change_features+0x95/0xe0
> __netdev_upper_dev_link+0xb20/0xc80
> netdev_upper_dev_link+0xb0/0x100
> macsec_newlink+0xb11/0x1200
> rtnl_newlink_create+0x329/0xb70
> rtnl_newlink+0x1666/0x1be0
--
Sabrina
