On Tue, Mar 10, 2026 at 08:17:01PM +0100, Sabrina Dubroca wrote:
> 2026-03-10, 10:02:09 -0700, syzbot ci wrote:
> > batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later):
> > interface not active
> > hsr_slave_0: entered promiscuous mode
> > hsr_slave_1: entered promiscuous mode
> > ------------[ cut here ]------------
> > err == -EMSGSIZE
> > WARNING: net/core/rtnetlink.c:4421 at rtmsg_ifinfo_build_skb+0x218/0x260,
> > CPU#0: syz-executor/6496
>
> I'm not sure this one is caused by this series, but either way,
rtnetlink_event+0x1b7/0x270
notifier_call_chain+0x1be/0x400
netdev_change_features+0x95/0xe0
__netdev_upper_dev_link+0xb20/0xc80
netdev_upper_dev_link+0xb0/0x100
This patch calls netdev_change_features() after __netdev_upper_dev_link(),
Which trigger a NETDEV_FEAT_CHANGE notify and calls rtmsg_ifinfo_event()
to fill the new link info. Maybe the event is a bit early and macsec has
data not ready?
Thanks
Hangbin
> reviewing if_nlmsg_size/rtnl_fill_ifinfo for mismatches is really
> unpleasant :/
>
> Things I see in rtnl_fill_ifinfo but don't find in if_nlmsg_size:
> - IFLA_PARENT_DEV_NAME
> - IFLA_PARENT_DEV_BUS_NAME
> (both from 00e77ed8e64d ("rtnetlink: add
> IFLA_PARENT_[DEV|DEV_BUS]_NAME"), which doesn't include a change to
> if_nlmsg_size)
> - rtnl_link_slave_info_fill also outputs IFLA_INFO_SLAVE_KIND + the
> IFLA_INFO_SLAVE_DATA nest, but rtnl_link_get_slave_info_data_size
> only counts the nest, and its caller (rtnl_link_get_size) doesn't
> have anything more about the slave info. This may be what syzbot is
> tripping on here.
>
>
> But there's a
>
> + nla_total_size(4) /* IFLA_WEIGHT */
>
> that doesn't get filled anywhere.
>
>
> > Modules linked in:
> > CPU: 0 UID: 0 PID: 6496 Comm: syz-executor Not tainted syzkaller #0
> > PREEMPT(full)
> > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> > 1.16.2-debian-1.16.2-1 04/01/2014
> > RIP: 0010:rtmsg_ifinfo_build_skb+0x218/0x260
> > Code: f6 ba 01 00 00 00 89 e9 e8 25 15 3a 00 4c 89 f0 48 83 c4 30 5b 41 5c
> > 41 5d 41 5e 41 5f 5d e9 7f 3a 2e 02 cc e8 49 3b 42 f8 90 <0f> 0b 90 eb 90
> > 89 d9 80 e1 07 fe c1 38 c1 0f 8c 95 fe ff ff 48 89
> > RSP: 0018:ffffc9000637e9a0 EFLAGS: 00010293
> > RAX: ffffffff89835e27 RBX: 0000000000000000 RCX: ffff8881b80a57c0
> > RDX: 0000000000000000 RSI: 00000000ffffffa6 RDI: 00000000ffffffa6
> > RBP: 00000000ffffffa6 R08: 0000000000000004 R09: 0000000000000004
> > R10: fffff52000c6fcdc R11: 0000000000000000 R12: 1ffff110235ddc21
> > R13: 0000000000000000 R14: ffff8881133dc780 R15: ffff88811aeee000
> > FS: 0000555557c4a500(0000) GS:ffff88818de65000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 000055555e1838c8 CR3: 0000000168b80000 CR4: 00000000000006f0
> > Call Trace:
> > <TASK>
> > rtnetlink_event+0x1b7/0x270
> > notifier_call_chain+0x1be/0x400
> > netdev_change_features+0x95/0xe0
> > __netdev_upper_dev_link+0xb20/0xc80
> > netdev_upper_dev_link+0xb0/0x100
> > macsec_newlink+0xb11/0x1200
> > rtnl_newlink_create+0x329/0xb70
> > rtnl_newlink+0x1666/0x1be0
>
> --
> Sabrina
