AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace test scripts in tools/testing/selftests/ and does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit e9e6b070b66a74daa3d4b4c1a801f7bce337a699\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Jul 25 04:15:23 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/drivers/net/config b/tools/testing/selftests/drivers/net/config\nindex 2070e890e064e5..f3933cf3e6be61 100644\n--- a/tools/testing/selftests/drivers/net/config\n+++ b/tools/testing/selftests/drivers/net/config\n@@ -4,8 +4,11 @@ CONFIG_DEBUG_INFO_BTF_MODULES=n\n CONFIG_INET_PSP=y\n CONFIG_IPV6=y\n CONFIG_MACSEC=m\n+CONFIG_NET_ACT_SKBEDIT=m\n CONFIG_NET_CLS_ACT=y\n CONFIG_NET_CLS_BPF=y\n+CONFIG_NET_CLS_FLOWER=m\n+CONFIG_NET_CLS_MATCHALL=m\n CONFIG_NETCONSOLE=m\n CONFIG_NETCONSOLE_DYNAMIC=y\n CONFIG_NETCONSOLE_EXTENDED_LOG=y\ndiff --git a/tools/testing/selftests/drivers/net/lib/py/env.py b/tools/testing/selftests/drivers/net/lib/py/env.py\nindex e4acf3d8333fd0..b1c6f6cef7dd25 100644\n--- a/tools/testing/selftests/drivers/net/lib/py/env.py\n+++ b/tools/testing/selftests/drivers/net/lib/py/env.py\n@@ -114,10 +114,11 @@ class NetDrvEpEnv(NetDrvEnvBase):\n     nsim_v4_pfx = \"192.0.2.\"\n     nsim_v6_pfx = \"2001:db8::\"\n \n-    def __init__(self, src_path, nsim_test=None):\n+    def __init__(self, src_path, nsim_test=None, queue_count=None):\n         super().__init__(src_path)\n \n         self._stats_settle_time = None\n+        self._queue_count = queue_count\n \n         # Things we try to destroy\n         self.remote = None\n@@ -173,9 +174,13 @@ class NetDrvEpEnv(NetDrvEnvBase):\n         self._required_cmd = {}\n \n     def create_local(self):\n+        nsim_kwargs = {}\n+        if self._queue_count:\n+            nsim_kwargs[\"queue_count\"] = self._queue_count\n+\n         self._netns = NetNS()\n-        self._ns = NetdevSimDev()\n-        self._ns_peer = NetdevSimDev(ns=self._netns)\n+        self._ns = NetdevSimDev(**nsim_kwargs)\n+        self._ns_peer = NetdevSimDev(ns=self._netns, **nsim_kwargs)\n \n         with open(\"/proc/self/ns/net\") as nsfd0, \\\n              open(\"/var/run/netns/\" + self._netns.name) as nsfd1:\ndiff --git a/tools/testing/selftests/drivers/net/ring_reconfig.py b/tools/testing/selftests/drivers/net/ring_reconfig.py\nindex f9530a8b08567f..a5a2defc4fb13c 100755\n--- a/tools/testing/selftests/drivers/net/ring_reconfig.py\n+++ b/tools/testing/selftests/drivers/net/ring_reconfig.py\n@@ -5,10 +5,21 @@\n Test channel and ring size configuration via ethtool (-L / -G).\n \"\"\"\n \n+import socket\n+import struct\n+import time\n+\n from lib.py import ksft_run, ksft_exit, ksft_pr\n from lib.py import ksft_eq\n+from lib.py import KsftSkipEx, KsftFailEx\n from lib.py import NetDrvEpEnv, EthtoolFamily, GenerateTraffic\n-from lib.py import defer, NlError\n+from lib.py import cmd, defer, rand_port, tc, NlError\n+\n+# Added in Python 3.13; fallback to 61 for x86/ARM/MIPS\n+SO_TXTIME = getattr(socket, \"SO_TXTIME\", 61)\n+\n+# TX ring size the test shrinks to so the ring fills quickly.\n+MIN_TX_RING = 64\n \n \n def channels(cfg) -\u003e None:\n@@ -151,14 +162,204 @@ def ringparam(cfg) -\u003e None:\n         GenerateTraffic(cfg).wait_pkts_and_stop(10000)\n \n \n+def _write_file(path, val):\n+    \"\"\"Write val to a file.\"\"\"\n+    with open(path, \"w\", encoding=\"utf-8\") as fp:\n+        fp.write(str(val))\n+\n+\n+def _write_sysfs(path, val):\n+    \"\"\"Write val to a sysfs file, restoring the original value on exit.\"\"\"\n+    with open(path, \"r\", encoding=\"utf-8\") as fp:\n+        orig_val = fp.read().strip()\n+    if str(val) == orig_val:\n+        return\n+    _write_file(path, val)\n+    defer(_write_file, path, orig_val)\n+\n+\n+def _get_qdisc_backlog(cfg, mq_handle, queue):\n+    \"\"\"Return the qdisc backlog (bytes) for the given TX queue's leaf.\"\"\"\n+    target_parent = f\"{mq_handle}{queue + 1:x}\"\n+    for q in tc(f\"-s qdisc show dev {cfg.ifname}\", json=True):\n+        if q.get(\"parent\", \"\") == target_parent:\n+            return q.get(\"backlog\") or 0\n+    return 0\n+\n+\n+def _setup_fq_qdisc(cfg, port, target_queue, other_queue):\n+    \"\"\"Put an fq qdisc on target_queue's leaf and return the mq handle in use.\n+\n+    We must not disturb the device's existing TX/RX qdisc policy. On a real\n+    NIC the root mq already has an addressable handle, so we leave the root\n+    and every other queue alone and only swap this one leaf, restoring its\n+    original qdisc afterwards.\n+    \"\"\"\n+    qdiscs = tc(f\"qdisc show dev {cfg.ifname}\", json=True)\n+    root = next((q for q in qdiscs if q.get(\"root\")), None)\n+\n+    if root and root[\"kind\"] == \"mq\" and root[\"handle\"] != \"0:\":\n+        # Addressable mq (previously-configured): touch only the target queue's\n+        # leaf and restore its original qdisc afterwards.\n+        mq_handle = root[\"handle\"]\n+        parent = f\"{mq_handle}{target_queue + 1:x}\"\n+        orig = next((q for q in qdiscs if q.get(\"parent\") == parent), None)\n+        orig_kind = orig[\"kind\"] if orig else \\\n+            cmd(\"sysctl -n net.core.default_qdisc\").stdout.strip()\n+        defer(tc, f\"qdisc replace dev {cfg.ifname} parent {parent} {orig_kind}\")\n+    elif root is None or root[\"kind\"] in (\"mq\", \"noqueue\"):\n+        # The auto-attached root mq has handle 0: on any device (real or sim),\n+        # which the kernel rejects as a qdisc parent. A 0: handle means the mq\n+        # is the untouched kernel default - no custom child qdiscs can hang off\n+        # an unaddressable parent - so installing a real handle and restoring\n+        # the default mq on exit preserves the device's effective policy.\n+        mq_handle = \"1:\"\n+        tc(f\"qdisc replace dev {cfg.ifname} root handle {mq_handle} mq\")\n+        defer(tc, f\"qdisc replace dev {cfg.ifname} root mq\")\n+        parent = f\"{mq_handle}{target_queue + 1:x}\"\n+    else:\n+        raise KsftSkipEx(f\"root qdisc '{root['kind']}' is not mq; \"\n+                         \"refusing to disturb existing qdisc policy\")\n+\n+    try:\n+        tc(f\"qdisc replace dev {cfg.ifname} parent {parent} fq\")\n+    except Exception as exc:\n+        raise KsftSkipEx(\n+            f\"fq not available (CONFIG_NET_SCH_FQ): {exc}\") from exc\n+\n+    qdisc_j = tc(f\"qdisc show dev {cfg.ifname}\", json=True)\n+    has_clsact = any(q['kind'] == 'clsact' for q in qdisc_j)\n+    if not has_clsact:\n+        tc(f\"qdisc add dev {cfg.ifname} clsact\")\n+        defer(tc, f\"qdisc del dev {cfg.ifname} clsact\")\n+\n+    proto = \"ipv6\" if int(cfg.addr_ipver) == 6 else \"ip\"\n+    try:\n+        tc(f\"filter add dev {cfg.ifname} egress protocol {proto} \"\n+           f\"pref 1 flower ip_proto udp dst_port {port} \"\n+           f\"action skbedit queue_mapping {target_queue}\")\n+    except Exception as exc:\n+        raise KsftSkipEx(\"tc flower/act_skbedit not available\") from exc\n+    defer(tc, f\"filter del dev {cfg.ifname} egress pref 1\")\n+\n+    tc(f\"filter add dev {cfg.ifname} egress pref 100 \"\n+       f\"matchall action skbedit queue_mapping {other_queue}\")\n+    defer(tc, f\"filter del dev {cfg.ifname} egress pref 100\")\n+\n+    return mq_handle\n+\n+\n+def _create_sotxtime_socket(cfg):\n+    \"\"\"Create a UDP socket with SO_TXTIME enabled, bound to the test device.\"\"\"\n+    sock = socket.socket(socket.AF_INET6 if cfg.addr_ipver == \"6\"\n+                         else socket.AF_INET, socket.SOCK_DGRAM)\n+    try:\n+        sock.setsockopt(socket.SOL_SOCKET, SO_TXTIME, struct.pack(\"Ii\", 1, 0))\n+    except OSError as exc:\n+        sock.close()\n+        raise KsftSkipEx(\"SO_TXTIME not supported\") from exc\n+    sock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,\n+                    cfg.ifname.encode())\n+    return sock\n+\n+\n+def _send_sotxtime_burst(cfg, sock, port, count, delay_ns):\n+    \"\"\"Send count UDP packets scheduled delay_ns ahead using SO_TXTIME.\"\"\"\n+    payload = b'\\x00' * 1400\n+    txtime_ns = time.clock_gettime_ns(time.CLOCK_MONOTONIC) + delay_ns\n+\n+    ancdata = [(socket.SOL_SOCKET, SO_TXTIME, struct.pack(\"Q\", txtime_ns))]\n+    if int(cfg.addr_ipver) == 6:\n+        dest = (cfg.remote_addr, port, 0, 0)\n+    else:\n+        dest = (cfg.remote_addr, port)\n+    for _ in range(count):\n+        sock.sendmsg([payload], ancdata, 0, dest)\n+\n+\n+def reconfig_tx_stall(cfg) -\u003e None:\n+    \"\"\"Test that qdisc backlog drains after ring reconfiguration.\"\"\"\n+    target_queue = 1\n+    other_queue = 0\n+\n+    ehdr = {'header': {'dev-index': cfg.ifindex}}\n+    chans = cfg.eth.channels_get(ehdr)\n+\n+    if \"combined-max\" not in chans:\n+        raise KsftSkipEx(\"device does not support combined channels\")\n+    if chans.get(\"combined-max\", 0) \u003c 2:\n+        raise KsftSkipEx(\"device does not support 2+ combined channels\")\n+    if chans[\"combined-count\"] \u003c 2:\n+        defer(cfg.eth.channels_set,\n+              ehdr | {\"combined-count\": chans[\"combined-count\"]})\n+        cfg.eth.channels_set(ehdr | {\"combined-count\": 2})\n+\n+    rings = cfg.eth.rings_get(ehdr)\n+    if 'rx' not in rings or 'tx' not in rings:\n+        raise KsftSkipEx(\"device does not expose rx/tx ring params\")\n+    tx_cur = rings['tx']\n+    if tx_cur \u003c= MIN_TX_RING:\n+        raise KsftSkipEx(\"tx ring size already at minimum\")\n+    defer(cfg.eth.rings_set, ehdr | {'tx': tx_cur})\n+\n+    cfg.eth.rings_set(ehdr | {'tx': MIN_TX_RING})\n+\n+    # Slow completions so the ring stays full after FQ releases packets\n+    napi_defer = f\"/sys/class/net/{cfg.ifname}/napi_defer_hard_irqs\"\n+    gro_timeout = f\"/sys/class/net/{cfg.ifname}/gro_flush_timeout\"\n+    _write_sysfs(napi_defer, 100)\n+    _write_sysfs(gro_timeout, 1000000000)\n+\n+    port = rand_port()\n+    mq_handle = _setup_fq_qdisc(cfg, port, target_queue, other_queue)\n+\n+    sock = _create_sotxtime_socket(cfg)\n+    defer(sock.close)\n+\n+    pkt_count = MIN_TX_RING * 2\n+\n+    for delay_ms in [100, 200, 500]:\n+        _send_sotxtime_burst(cfg, sock, port, pkt_count,\n+                             delay_ms * 1_000_000)\n+        ksft_pr(f\"Sent {pkt_count} SO_TXTIME packets (+{delay_ms}ms)\")\n+        time.sleep(delay_ms / 1000 + 0.3)\n+\n+        backlog = _get_qdisc_backlog(cfg, mq_handle, target_queue)\n+        if backlog:\n+            break\n+    else:\n+        raise KsftFailEx(\"failed to build qdisc backlog\")\n+\n+    ksft_pr(f\"Backlog before reconfig: {backlog} bytes\")\n+\n+    # Trigger ring reconfig — driver should call wake, not just start\n+    cfg.eth.rings_set(ehdr | {'tx': tx_cur})\n+\n+    # Let completions proceed normally\n+    _write_sysfs(napi_defer, 0)\n+    _write_sysfs(gro_timeout, 0)\n+\n+    # Poll for backlog to drain\n+    for _ in range(100):\n+        backlog = _get_qdisc_backlog(cfg, mq_handle, target_queue)\n+        if not backlog:\n+            break\n+        time.sleep(0.1)\n+\n+    ksft_eq(0, backlog,\n+            comment=f\"qdisc backlog stuck on queue {target_queue} \"\n+                    f\"after ring reconfig\")\n+\n+\n def main() -\u003e None:\n     \"\"\" Ksft boiler plate main \"\"\"\n \n-    with NetDrvEpEnv(__file__) as cfg:\n+    with NetDrvEpEnv(__file__, queue_count=2) as cfg:\n         cfg.eth = EthtoolFamily()\n \n         ksft_run([channels,\n-                  ringparam],\n+                  ringparam,\n+                  reconfig_tx_stall],\n                  args=(cfg, ))\n     ksft_exit()\n \n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace test scripts in tools/testing/selftests/ and does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e9e6b070b66a74daa3d4b4c1a801f7bce337a699
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Jul 25 04:15:23 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/drivers/net/config b/tools/testing/selftests/drivers/net/config
index 2070e890e064e5..f3933cf3e6be61 100644
--- a/tools/testing/selftests/drivers/net/config
+++ b/tools/testing/selftests/drivers/net/config
@@ -4,8 +4,11 @@ CONFIG_DEBUG_INFO_BTF_MODULES=n
 CONFIG_INET_PSP=y
 CONFIG_IPV6=y
 CONFIG_MACSEC=m
+CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_MATCHALL=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_NETCONSOLE_EXTENDED_LOG=y
diff --git a/tools/testing/selftests/drivers/net/lib/py/env.py b/tools/testing/selftests/drivers/net/lib/py/env.py
index e4acf3d8333fd0..b1c6f6cef7dd25 100644
--- a/tools/testing/selftests/drivers/net/lib/py/env.py
+++ b/tools/testing/selftests/drivers/net/lib/py/env.py
@@ -114,10 +114,11 @@ class NetDrvEpEnv(NetDrvEnvBase):
     nsim_v4_pfx = "192.0.2."
     nsim_v6_pfx = "2001:db8::"
 
-    def __init__(self, src_path, nsim_test=None):
+    def __init__(self, src_path, nsim_test=None, queue_count=None):
         super().__init__(src_path)
 
         self._stats_settle_time = None
+        self._queue_count = queue_count
 
         # Things we try to destroy
         self.remote = None
@@ -173,9 +174,13 @@ class NetDrvEpEnv(NetDrvEnvBase):
         self._required_cmd = {}
 
     def create_local(self):
+        nsim_kwargs = {}
+        if self._queue_count:
+            nsim_kwargs["queue_count"] = self._queue_count
+
         self._netns = NetNS()
-        self._ns = NetdevSimDev()
-        self._ns_peer = NetdevSimDev(ns=self._netns)
+        self._ns = NetdevSimDev(**nsim_kwargs)
+        self._ns_peer = NetdevSimDev(ns=self._netns, **nsim_kwargs)
 
         with open("/proc/self/ns/net") as nsfd0, \
              open("/var/run/netns/" + self._netns.name) as nsfd1:
diff --git a/tools/testing/selftests/drivers/net/ring_reconfig.py b/tools/testing/selftests/drivers/net/ring_reconfig.py
index f9530a8b08567f..a5a2defc4fb13c 100755
--- a/tools/testing/selftests/drivers/net/ring_reconfig.py
+++ b/tools/testing/selftests/drivers/net/ring_reconfig.py
@@ -5,10 +5,21 @@
 Test channel and ring size configuration via ethtool (-L / -G).
 """
 
+import socket
+import struct
+import time
+
 from lib.py import ksft_run, ksft_exit, ksft_pr
 from lib.py import ksft_eq
+from lib.py import KsftSkipEx, KsftFailEx
 from lib.py import NetDrvEpEnv, EthtoolFamily, GenerateTraffic
-from lib.py import defer, NlError
+from lib.py import cmd, defer, rand_port, tc, NlError
+
+# Added in Python 3.13; fallback to 61 for x86/ARM/MIPS
+SO_TXTIME = getattr(socket, "SO_TXTIME", 61)
+
+# TX ring size the test shrinks to so the ring fills quickly.
+MIN_TX_RING = 64
 
 
 def channels(cfg) -> None:
@@ -151,14 +162,204 @@ def ringparam(cfg) -> None:
         GenerateTraffic(cfg).wait_pkts_and_stop(10000)
 
 
+def _write_file(path, val):
+    """Write val to a file."""
+    with open(path, "w", encoding="utf-8") as fp:
+        fp.write(str(val))
+
+
+def _write_sysfs(path, val):
+    """Write val to a sysfs file, restoring the original value on exit."""
+    with open(path, "r", encoding="utf-8") as fp:
+        orig_val = fp.read().strip()
+    if str(val) == orig_val:
+        return
+    _write_file(path, val)
+    defer(_write_file, path, orig_val)
+
+
+def _get_qdisc_backlog(cfg, mq_handle, queue):
+    """Return the qdisc backlog (bytes) for the given TX queue's leaf."""
+    target_parent = f"{mq_handle}{queue + 1:x}"
+    for q in tc(f"-s qdisc show dev {cfg.ifname}", json=True):
+        if q.get("parent", "") == target_parent:
+            return q.get("backlog") or 0
+    return 0
+
+
+def _setup_fq_qdisc(cfg, port, target_queue, other_queue):
+    """Put an fq qdisc on target_queue's leaf and return the mq handle in use.
+
+    We must not disturb the device's existing TX/RX qdisc policy. On a real
+    NIC the root mq already has an addressable handle, so we leave the root
+    and every other queue alone and only swap this one leaf, restoring its
+    original qdisc afterwards.
+    """
+    qdiscs = tc(f"qdisc show dev {cfg.ifname}", json=True)
+    root = next((q for q in qdiscs if q.get("root")), None)
+
+    if root and root["kind"] == "mq" and root["handle"] != "0:":
+        # Addressable mq (previously-configured): touch only the target queue's
+        # leaf and restore its original qdisc afterwards.
+        mq_handle = root["handle"]
+        parent = f"{mq_handle}{target_queue + 1:x}"
+        orig = next((q for q in qdiscs if q.get("parent") == parent), None)
+        orig_kind = orig["kind"] if orig else \
+            cmd("sysctl -n net.core.default_qdisc").stdout.strip()
+        defer(tc, f"qdisc replace dev {cfg.ifname} parent {parent} {orig_kind}")
+    elif root is None or root["kind"] in ("mq", "noqueue"):
+        # The auto-attached root mq has handle 0: on any device (real or sim),
+        # which the kernel rejects as a qdisc parent. A 0: handle means the mq
+        # is the untouched kernel default - no custom child qdiscs can hang off
+        # an unaddressable parent - so installing a real handle and restoring
+        # the default mq on exit preserves the device's effective policy.
+        mq_handle = "1:"
+        tc(f"qdisc replace dev {cfg.ifname} root handle {mq_handle} mq")
+        defer(tc, f"qdisc replace dev {cfg.ifname} root mq")
+        parent = f"{mq_handle}{target_queue + 1:x}"
+    else:
+        raise KsftSkipEx(f"root qdisc '{root['kind']}' is not mq; "
+                         "refusing to disturb existing qdisc policy")
+
+    try:
+        tc(f"qdisc replace dev {cfg.ifname} parent {parent} fq")
+    except Exception as exc:
+        raise KsftSkipEx(
+            f"fq not available (CONFIG_NET_SCH_FQ): {exc}") from exc
+
+    qdisc_j = tc(f"qdisc show dev {cfg.ifname}", json=True)
+    has_clsact = any(q['kind'] == 'clsact' for q in qdisc_j)
+    if not has_clsact:
+        tc(f"qdisc add dev {cfg.ifname} clsact")
+        defer(tc, f"qdisc del dev {cfg.ifname} clsact")
+
+    proto = "ipv6" if int(cfg.addr_ipver) == 6 else "ip"
+    try:
+        tc(f"filter add dev {cfg.ifname} egress protocol {proto} "
+           f"pref 1 flower ip_proto udp dst_port {port} "
+           f"action skbedit queue_mapping {target_queue}")
+    except Exception as exc:
+        raise KsftSkipEx("tc flower/act_skbedit not available") from exc
+    defer(tc, f"filter del dev {cfg.ifname} egress pref 1")
+
+    tc(f"filter add dev {cfg.ifname} egress pref 100 "
+       f"matchall action skbedit queue_mapping {other_queue}")
+    defer(tc, f"filter del dev {cfg.ifname} egress pref 100")
+
+    return mq_handle
+
+
+def _create_sotxtime_socket(cfg):
+    """Create a UDP socket with SO_TXTIME enabled, bound to the test device."""
+    sock = socket.socket(socket.AF_INET6 if cfg.addr_ipver == "6"
+                         else socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        sock.setsockopt(socket.SOL_SOCKET, SO_TXTIME, struct.pack("Ii", 1, 0))
+    except OSError as exc:
+        sock.close()
+        raise KsftSkipEx("SO_TXTIME not supported") from exc
+    sock.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
+                    cfg.ifname.encode())
+    return sock
+
+
+def _send_sotxtime_burst(cfg, sock, port, count, delay_ns):
+    """Send count UDP packets scheduled delay_ns ahead using SO_TXTIME."""
+    payload = b'\x00' * 1400
+    txtime_ns = time.clock_gettime_ns(time.CLOCK_MONOTONIC) + delay_ns
+
+    ancdata = [(socket.SOL_SOCKET, SO_TXTIME, struct.pack("Q", txtime_ns))]
+    if int(cfg.addr_ipver) == 6:
+        dest = (cfg.remote_addr, port, 0, 0)
+    else:
+        dest = (cfg.remote_addr, port)
+    for _ in range(count):
+        sock.sendmsg([payload], ancdata, 0, dest)
+
+
+def reconfig_tx_stall(cfg) -> None:
+    """Test that qdisc backlog drains after ring reconfiguration."""
+    target_queue = 1
+    other_queue = 0
+
+    ehdr = {'header': {'dev-index': cfg.ifindex}}
+    chans = cfg.eth.channels_get(ehdr)
+
+    if "combined-max" not in chans:
+        raise KsftSkipEx("device does not support combined channels")
+    if chans.get("combined-max", 0) < 2:
+        raise KsftSkipEx("device does not support 2+ combined channels")
+    if chans["combined-count"] < 2:
+        defer(cfg.eth.channels_set,
+              ehdr | {"combined-count": chans["combined-count"]})
+        cfg.eth.channels_set(ehdr | {"combined-count": 2})
+
+    rings = cfg.eth.rings_get(ehdr)
+    if 'rx' not in rings or 'tx' not in rings:
+        raise KsftSkipEx("device does not expose rx/tx ring params")
+    tx_cur = rings['tx']
+    if tx_cur <= MIN_TX_RING:
+        raise KsftSkipEx("tx ring size already at minimum")
+    defer(cfg.eth.rings_set, ehdr | {'tx': tx_cur})
+
+    cfg.eth.rings_set(ehdr | {'tx': MIN_TX_RING})
+
+    # Slow completions so the ring stays full after FQ releases packets
+    napi_defer = f"/sys/class/net/{cfg.ifname}/napi_defer_hard_irqs"
+    gro_timeout = f"/sys/class/net/{cfg.ifname}/gro_flush_timeout"
+    _write_sysfs(napi_defer, 100)
+    _write_sysfs(gro_timeout, 1000000000)
+
+    port = rand_port()
+    mq_handle = _setup_fq_qdisc(cfg, port, target_queue, other_queue)
+
+    sock = _create_sotxtime_socket(cfg)
+    defer(sock.close)
+
+    pkt_count = MIN_TX_RING * 2
+
+    for delay_ms in [100, 200, 500]:
+        _send_sotxtime_burst(cfg, sock, port, pkt_count,
+                             delay_ms * 1_000_000)
+        ksft_pr(f"Sent {pkt_count} SO_TXTIME packets (+{delay_ms}ms)")
+        time.sleep(delay_ms / 1000 + 0.3)
+
+        backlog = _get_qdisc_backlog(cfg, mq_handle, target_queue)
+        if backlog:
+            break
+    else:
+        raise KsftFailEx("failed to build qdisc backlog")
+
+    ksft_pr(f"Backlog before reconfig: {backlog} bytes")
+
+    # Trigger ring reconfig — driver should call wake, not just start
+    cfg.eth.rings_set(ehdr | {'tx': tx_cur})
+
+    # Let completions proceed normally
+    _write_sysfs(napi_defer, 0)
+    _write_sysfs(gro_timeout, 0)
+
+    # Poll for backlog to drain
+    for _ in range(100):
+        backlog = _get_qdisc_backlog(cfg, mq_handle, target_queue)
+        if not backlog:
+            break
+        time.sleep(0.1)
+
+    ksft_eq(0, backlog,
+            comment=f"qdisc backlog stuck on queue {target_queue} "
+                    f"after ring reconfig")
+
+
 def main() -> None:
     """ Ksft boiler plate main """
 
-    with NetDrvEpEnv(__file__) as cfg:
+    with NetDrvEpEnv(__file__, queue_count=2) as cfg:
         cfg.eth = EthtoolFamily()
 
         ksft_run([channels,
-                  ringparam],
+                  ringparam,
+                  reconfig_tx_stall],
                  args=(cfg, ))
     ksft_exit()
 

gemini-3.1-pro-preview

null

null

							input: 5759
							output: 65
							thoughts: 695
						

**WorthFuzzing Assessment**

Okay, let's break this down. My initial scan indicated some changes within the `tools/testing/selftests/drivers/net` directory, specifically to `config`, `env.py`, and `ring_reconfig.py`. That immediately pinged my internal alarm bells; however, a closer look confirms these are *only* selftest modifications. It adds configurations, tweaks a Python environment setup script, and introduces a new test case (`reconfig_tx_stall`).

My first thought was to verify that there are no core kernel changes. I re-examined the patch diff. Yes, it only touches those selftest files. This is important: it *doesn't* touch core kernel logic, drivers, or architectures. The changes are confined to the self-test framework, meaning it's userspace test code.

Now I need to ensure I'm making a correct assessment based on my existing knowledge. I'm recalling the instructions: "Return WorthFuzzing=false if the patch only contains [...]" And I'm looking for a catch. While selftests aren't *explicitly* listed, it falls squarely under the principle of not functionally altering the execution flow of the kernel itself. This is an important distinction.

I go back to my instructions. "If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true." That's the other side of the coin. Since we're dealing with test code and *not* core kernel changes, this is a clear "false."

Alright, it's pretty straightforward. No functional kernel changes, just selftest additions. Time to set `WorthFuzzing=false` and move on. There's nothing to fuzz here.

Here are the results I'm setting:
WorthFuzzing=false
Reasoning: The patch only adds a new test script to the kernel selftests (tools/testing/selftests/) and does not modify any core kernel logic, drivers, or architectures.
FocusSymbols: []
EnableConfigs: []

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace test scripts in tools/testing/selftests/ and does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace test scripts in tools/testing/selftests/ and does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}