syzbot

netlink: 'syz.0.17': attribute type 13 has an invalid length.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4455 at kernel/softirq.c:401 __local_bh_enable_ip+0x25c/0x37c kernel/softirq.c:401
Modules linked in:
CPU: 0 PID: 4455 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 224000c5 (nzCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __local_bh_enable_ip+0x25c/0x37c kernel/softirq.c:401
lr : __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
lr : _raw_spin_unlock_bh+0x48/0x58 kernel/locking/spinlock.c:210
sp : ffff8000209a6820
x29: ffff8000209a6830 x28: dfff800000000000 x27: dfff800000000000
x26: fffffc0003785e00 x25: 1fffe0001a7aba69 x24: 0000000000000000
x23: dfff800000000000 x22: 1fffe0001a7aba69 x21: ffff80000febb310
x20: 0000000000000201 x19: ffff0000d3d5d348 x18: ffff800011b9bf60
x17: ffff80001835b000 x16: ffff8000082eef80 x15: ffff800017e3c000
x14: 0000000000000001 x13: 1fffe0001aa596b9 x12: 0000000000000000
x11: 0000000000000000 x10: ffff60001aa596ba x9 : 0000000000000000
x8 : 0000000100000203 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff8000185175e8 x4 : 0000000000000008 x3 : ffff8000082ef094
x2 : 0000000000000001 x1 : 0000000000000201 x0 : ffff80000febb310
Call trace:
 __local_bh_enable_ip+0x25c/0x37c kernel/softirq.c:401
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x48/0x58 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 page_pool_producer_unlock net/core/page_pool.c:156 [inline]
 page_pool_recycle_in_ring net/core/page_pool.c:549 [inline]
 page_pool_put_defragged_page+0x5d4/0x9f8 net/core/page_pool.c:631
 page_pool_put_page include/net/page_pool.h:326 [inline]
 page_pool_put_full_page include/net/page_pool.h:334 [inline]
 __xdp_return+0x3ac/0x518 net/core/xdp.c:384
 xdp_return_frame+0x90/0x264 net/core/xdp.c:419
 tun_ptr_free drivers/net/tun.c:617 [inline]
 __ptr_ring_swap_queue include/linux/ptr_ring.h:570 [inline]
 ptr_ring_resize_multiple include/linux/ptr_ring.h:641 [inline]
 tun_queue_resize drivers/net/tun.c:3666 [inline]
 tun_device_event+0x8e4/0xe80 drivers/net/tun.c:3686
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 dev_change_tx_queue_len+0x174/0x2d4 net/core/dev.c:8862
 do_setlink+0xd18/0x3434 net/core/rtnetlink.c:2859
 rtnl_group_changelink net/core/rtnetlink.c:3366 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3623 [inline]
 rtnl_newlink+0xd04/0x1a54 net/core/rtnetlink.c:3660
 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6157
 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6175
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5c8/0x938 net/socket.c:2518
 ___sys_sendmsg net/socket.c:2572 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2601
 __do_sys_sendmsg net/socket.c:2610 [inline]
 __se_sys_sendmsg net/socket.c:2608 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2608
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4981
hardirqs last  enabled at (4979): [<ffff800011b23a44>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (4979): [<ffff800011b23a44>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (4980): [<ffff800011b23868>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (4980): [<ffff800011b23868>] _raw_spin_lock_irqsave+0xa4/0xb0 kernel/locking/spinlock.c:162
softirqs last  enabled at (4954): [<ffff800010835040>] inet6_fill_ifla6_attrs+0xc8c/0x1ba8 net/ipv6/addrconf.c:5770
softirqs last disabled at (4981): [<ffff80000febb018>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (4981): [<ffff80000febb018>] page_pool_producer_lock net/core/page_pool.c:144 [inline]
softirqs last disabled at (4981): [<ffff80000febb018>] page_pool_recycle_in_ring net/core/page_pool.c:545 [inline]
softirqs last disabled at (4981): [<ffff80000febb018>] page_pool_put_defragged_page+0x2dc/0x9f8 net/core/page_pool.c:631
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
raw_local_irq_restore() called with IRQs enabled
WARNING: CPU: 0 PID: 4455 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x44 kernel/locking/irqflag-debug.c:10
Modules linked in:
CPU: 0 PID: 4455 Comm: syz.0.17 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : warn_bogus_irq_restore+0x34/0x44 kernel/locking/irqflag-debug.c:10
lr : warn_bogus_irq_restore+0x34/0x44 kernel/locking/irqflag-debug.c:10
sp : ffff8000209a6980
x29: ffff8000209a6980 x28: 0000000000000000 x27: 1fffe0001df6bd30
x26: 0000000000000000 x25: dfff800000000000 x24: 1fffe0001df6bd31
x23: 0000000000000000 x22: ffff0000d4a0d800 x21: ffff0000efb5e988
x20: ffff0000efb5e908 x19: 0000000000000000 x18: ffff800011b9bf60
x17: 0000000000000000 x16: ffff8000082d92bc x15: 0000000000000000
x14: 0000000000000001 x13: 1ffff00004134c80 x12: 0000000000ff0100
x11: ff00800008194250 x10: 0000000000000000 x9 : a6c39171e5db7000
x8 : a6c39171e5db7000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000209a6418 x4 : ffff800015304cc0 x3 : ffff800008319678
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 warn_bogus_irq_restore+0x34/0x44 kernel/locking/irqflag-debug.c:10
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0xa0/0xac kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 ptr_ring_resize_multiple include/linux/ptr_ring.h:644 [inline]
 tun_queue_resize drivers/net/tun.c:3666 [inline]
 tun_device_event+0xbf8/0xe80 drivers/net/tun.c:3686
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 dev_change_tx_queue_len+0x174/0x2d4 net/core/dev.c:8862
 do_setlink+0xd18/0x3434 net/core/rtnetlink.c:2859
 rtnl_group_changelink net/core/rtnetlink.c:3366 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3623 [inline]
 rtnl_newlink+0xd04/0x1a54 net/core/rtnetlink.c:3660
 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6157
 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6175
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5c8/0x938 net/socket.c:2518
 ___sys_sendmsg net/socket.c:2572 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2601
 __do_sys_sendmsg net/socket.c:2610 [inline]
 __se_sys_sendmsg net/socket.c:2608 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2608
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 10956
hardirqs last  enabled at (10955): [<ffff80000830fac4>] __up_console_sem+0xb4/0xfc kernel/printk/printk.c:261
hardirqs last disabled at (10956): [<ffff800011a38914>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (10932): [<ffff80000febb310>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (10932): [<ffff80000febb310>] page_pool_producer_unlock net/core/page_pool.c:156 [inline]
softirqs last  enabled at (10932): [<ffff80000febb310>] page_pool_recycle_in_ring net/core/page_pool.c:549 [inline]
softirqs last  enabled at (10932): [<ffff80000febb310>] page_pool_put_defragged_page+0x5d4/0x9f8 net/core/page_pool.c:631
softirqs last disabled at (10930): [<ffff80000febb018>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (10930): [<ffff80000febb018>] page_pool_producer_lock net/core/page_pool.c:144 [inline]
softirqs last disabled at (10930): [<ffff80000febb018>] page_pool_recycle_in_ring net/core/page_pool.c:545 [inline]
softirqs last disabled at (10930): [<ffff80000febb018>] page_pool_put_defragged_page+0x2dc/0x9f8 net/core/page_pool.c:631
---[ end trace 0000000000000000 ]---
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready