# Reproducer (inside any QEMU VM running net-next with CONFIG_FAILSLAB=y,
# CONFIG_FAULT_INJECTION_DEBUG_FS=y, and a netdev driver that implements
# ndo_set_rx_mode_async, e.g. netdevsim):
#
#     echo 100 > /sys/kernel/debug/failslab/probability
#     echo Y   > /sys/kernel/debug/failslab/task-filter
#     echo Y   > /sys/kernel/debug/failslab/ignore-gfp-wait
#     echo 1   > /sys/kernel/slab/kmalloc-128/failslab
#     (echo 1 > /proc/self/make-it-fail; exec ./trigger)
#
# where ./trigger creates a netdevsim device and issues SIOCADDMULTI on it.
# Without the patch the WARN at net/core/dev_addr_lists.c:1278 fires
# every run.
#
# The knob helps to mimic memory pressure scenario and reliably reproduce
# the WARN:
#
#   probability=100
#       Once an allocation in our task is selected for failure (by
#       task-filter + cache-filter), fail it with 100% probability.
#
#   task-filter=Y
#       Restrict fault injection to processes tagged via
#       /proc/<pid>/make-it-fail. Without this, every kmalloc-128 in the
#       whole kernel fails, including ones inside kworker / softirq
#       contexts that the system relies on to stay alive, and the VM
#       falls over before the reproducer runs. With it, only our trigger
#       process sees failures.
#
#   ignore-gfp-wait=Y
#       Skip allocations that may sleep (GFP_KERNEL, GFP_NOFS, ...). The
#       target kmalloc inside __hw_addr_create() is GFP_ATOMIC because
#       it runs under netif_addr_lock_bh(). Setting ignore-gfp-wait=Y
#       confines failures to the GFP_ATOMIC class so we don't fail
#       unrelated GFP_KERNEL allocations on the same setup path
#       (sandbox unshare(), netlink ifup, etc.) and abort the trigger
#       before it reaches the snapshot.
#
#   /sys/kernel/slab/kmalloc-128/failslab=1  (paired with cache-filter=Y
#   via /sys/kernel/debug/failslab/cache-filter, set automatically by
#   syzkaller's standard fault setup or explicitly in setup scripts)
#       sizeof(struct netdev_hw_addr) is ~104 bytes, which rounds up to
#       the kmalloc-128 slab. Marking that one cache as failable (with
#       cache-filter=Y telling failslab to honour per-cache opt-in)
#       narrows fault injection to the exact slab the bug needs.
#
#   echo 1 > /proc/self/make-it-fail  (inside the trigger task only)
#       Arms task-filter for this specific task. Must be done AFTER any
#       setup that allocates kmalloc-128 (open(), bind(), write_file,
#       socket(), etc.) and BEFORE the SIOCADDMULTI ioctl, so the fault
#       lands inside netif_addr_lists_snapshot() and not in setup.
#
# {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8931, &(0x7f0000000000)={'netdevsim0\x00'}) (fail_nth: 3)