AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies Intel Ethernet drivers (e1000e, i40e, ice) which require physical PCI hardware to be probed. The e1000e changes are specific to ICH8LAN/PCH MAC types and a DMI quirk, which are not emulated by QEMU (QEMU emulates the 82574L MAC). The i40e change is a trivial debug macro fix. The ice changes are for the Intel E800 series, which lacks software emulation in standard virtualized environments. Since the modified code paths cannot be reached without the specific physical hardware, this patch does not need to be fuzzed.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 54ca21b36f5c088e865f3c5de54ca2ca7cb2f975\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 22 22:14:35 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c\nindex dea208db1be5bf..aa90e0ce8acaf8 100644\n--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c\n+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c\n@@ -1594,6 +1594,9 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)\n \t\t\tphy_reg \u0026= ~I217_PLL_CLOCK_GATE_MASK;\n \t\t\tif (speed == SPEED_100 || speed == SPEED_10)\n \t\t\t\tphy_reg |= 0x3E8;\n+\t\t\telse if (hw-\u003emac.type == e1000_pch_mtp ||\n+\t\t\t\t hw-\u003emac.type == e1000_pch_ptp)\n+\t\t\t\tphy_reg |= 0x1D5;\n \t\t\telse\n \t\t\t\tphy_reg |= 0xFA;\n \t\t\te1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg);\ndiff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c\nindex 808e5cddd6a918..844f31ab37ad44 100644\n--- a/drivers/net/ethernet/intel/e1000e/netdev.c\n+++ b/drivers/net/ethernet/intel/e1000e/netdev.c\n@@ -25,6 +25,7 @@\n #include \u003clinux/pm_runtime.h\u003e\n #include \u003clinux/prefetch.h\u003e\n #include \u003clinux/suspend.h\u003e\n+#include \u003clinux/dmi.h\u003e\n \n #include \"e1000.h\"\n #define CREATE_TRACE_POINTS\n@@ -58,6 +59,17 @@ static const struct e1000_info *e1000_info_tbl[] = {\n \t[board_pch_ptp]\t\t= \u0026e1000_pch_ptp_info,\n };\n \n+static const struct dmi_system_id disable_k1_list[] = {\n+\t{\n+\t\t.ident = \"Dell Pro 16 Plus PB16250\",\n+\t\t.matches = {\n+\t\t\tDMI_MATCH(DMI_SYS_VENDOR, \"Dell Inc.\"),\n+\t\t\tDMI_MATCH(DMI_PRODUCT_NAME, \"Dell Pro 16 Plus PB16250\"),\n+\t\t},\n+\t},\n+\t{}\n+};\n+\n struct e1000_reg_info {\n \tu32 ofs;\n \tchar *name;\n@@ -7670,7 +7682,8 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n \t/* init PTP hardware clock */\n \te1000e_ptp_init(adapter);\n \n-\tif (hw-\u003emac.type \u003e= e1000_pch_mtp)\n+\t/* disable K1 by default on known problematic systems */\n+\tif (hw-\u003emac.type \u003e= e1000_pch_mtp \u0026\u0026 dmi_check_system(disable_k1_list))\n \t\tadapter-\u003eflags2 |= FLAG2_DISABLE_K1;\n \n \t/* reset the hardware with the new settings */\ndiff --git a/drivers/net/ethernet/intel/i40e/i40e_debug.h b/drivers/net/ethernet/intel/i40e/i40e_debug.h\nindex e9871dfb32bd44..01fd70db908666 100644\n--- a/drivers/net/ethernet/intel/i40e/i40e_debug.h\n+++ b/drivers/net/ethernet/intel/i40e/i40e_debug.h\n@@ -42,7 +42,7 @@ struct device *i40e_hw_to_dev(struct i40e_hw *hw);\n #define i40e_debug(h, m, s, ...)\t\t\t\t\\\n do {\t\t\t\t\t\t\t\t\\\n \tif (((m) \u0026 (h)-\u003edebug_mask))\t\t\t\t\\\n-\t\tdev_info(i40e_hw_to_dev(hw), s, ##__VA_ARGS__);\t\\\n+\t\tdev_info(i40e_hw_to_dev(h), s, ##__VA_ARGS__);\t\\\n } while (0)\n \n #endif /* _I40E_DEBUG_H_ */\ndiff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c\nindex 31e0de9e7f6075..ef1ce106f81b5e 100644\n--- a/drivers/net/ethernet/intel/ice/ice_common.c\n+++ b/drivers/net/ethernet/intel/ice/ice_common.c\n@@ -3882,7 +3882,6 @@ ice_set_fc(struct ice_port_info *pi, u8 *aq_failures, bool ena_auto_link_update)\n \tif (!pi || !aq_failures)\n \t\treturn -EINVAL;\n \n-\t*aq_failures = 0;\n \thw = pi-\u003ehw;\n \n \tpcaps = kzalloc_obj(*pcaps);\ndiff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c\nindex 462c69cc11e19d..30c3a4db7d611c 100644\n--- a/drivers/net/ethernet/intel/ice/ice_dpll.c\n+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c\n@@ -4645,9 +4645,13 @@ ice_dpll_init_pins_info(struct ice_pf *pf, enum ice_dpll_pin_type pin_type)\n static void ice_dpll_deinit_info(struct ice_pf *pf)\n {\n \tkfree(pf-\u003edplls.inputs);\n+\tpf-\u003edplls.inputs = NULL;\n \tkfree(pf-\u003edplls.outputs);\n+\tpf-\u003edplls.outputs = NULL;\n \tkfree(pf-\u003edplls.eec.input_prio);\n+\tpf-\u003edplls.eec.input_prio = NULL;\n \tkfree(pf-\u003edplls.pps.input_prio);\n+\tpf-\u003edplls.pps.input_prio = NULL;\n }\n \n /**\n@@ -4748,12 +4752,16 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu)\n \n \talloc_size = sizeof(*de-\u003einput_prio) * d-\u003enum_inputs;\n \tde-\u003einput_prio = kzalloc(alloc_size, GFP_KERNEL);\n-\tif (!de-\u003einput_prio)\n-\t\treturn -ENOMEM;\n+\tif (!de-\u003einput_prio) {\n+\t\tret = -ENOMEM;\n+\t\tgoto deinit_info;\n+\t}\n \n \tdp-\u003einput_prio = kzalloc(alloc_size, GFP_KERNEL);\n-\tif (!dp-\u003einput_prio)\n-\t\treturn -ENOMEM;\n+\tif (!dp-\u003einput_prio) {\n+\t\tret = -ENOMEM;\n+\t\tgoto deinit_info;\n+\t}\n \n \tret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_INPUT);\n \tif (ret)\n@@ -4778,12 +4786,12 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu)\n \tret = ice_get_cgu_rclk_pin_info(\u0026pf-\u003ehw, \u0026d-\u003ebase_rclk_idx,\n \t\t\t\t\t\u0026pf-\u003edplls.rclk.num_parents);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto deinit_info;\n \tfor (i = 0; i \u003c pf-\u003edplls.rclk.num_parents; i++)\n \t\tpf-\u003edplls.rclk.parent_idx[i] = d-\u003ebase_rclk_idx + i;\n \tret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_RCLK_INPUT);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto deinit_info;\n \tde-\u003emode = DPLL_MODE_AUTOMATIC;\n \tdp-\u003emode = DPLL_MODE_AUTOMATIC;\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c\nindex 2e4f0969035f77..c30e27bbfe6e25 100644\n--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c\n+++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c\n@@ -117,8 +117,6 @@ static int ice_eswitch_setup_repr(struct ice_pf *pf, struct ice_repr *repr)\n \tif (!repr-\u003edst)\n \t\treturn -ENOMEM;\n \n-\tnetif_keep_dst(uplink_vsi-\u003enetdev);\n-\n \tdst = repr-\u003edst;\n \tdst-\u003eu.port_info.port_id = vsi-\u003evsi_num;\n \tdst-\u003eu.port_info.lower_dev = uplink_vsi-\u003enetdev;\n@@ -312,6 +310,8 @@ static int ice_eswitch_enable_switchdev(struct ice_pf *pf)\n \tif (ice_eswitch_br_offloads_init(pf))\n \t\tgoto err_br_offloads;\n \n+\tnetif_keep_dst(uplink_vsi-\u003enetdev);\n+\n \tpf-\u003eeswitch.is_running = true;\n \n \treturn 0;\ndiff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c\nindex 236d293aba984a..49371b06584582 100644\n--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c\n+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c\n@@ -3508,7 +3508,7 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)\n \tstruct ice_vsi *vsi = np-\u003evsi;\n \tstruct ice_hw *hw = \u0026pf-\u003ehw;\n \tstruct ice_port_info *pi;\n-\tu8 aq_failures;\n+\tu8 aq_failures = 0;\n \tbool link_up;\n \tu32 is_an;\n \tint err;\n@@ -3579,18 +3579,22 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)\n \t/* Set the FC mode and only restart AN if link is up */\n \terr = ice_set_fc(pi, \u0026aq_failures, link_up);\n \n-\tif (aq_failures \u0026 ICE_SET_FC_AQ_FAIL_GET) {\n+\tswitch (aq_failures) {\n+\tcase ICE_SET_FC_AQ_FAIL_GET:\n \t\tnetdev_info(netdev, \"Set fc failed on the get_phy_capabilities call with err %d aq_err %s\\n\",\n \t\t\t    err, libie_aq_str(hw-\u003eadminq.sq_last_status));\n \t\terr = -EAGAIN;\n-\t} else if (aq_failures \u0026 ICE_SET_FC_AQ_FAIL_SET) {\n+\t\tbreak;\n+\tcase ICE_SET_FC_AQ_FAIL_SET:\n \t\tnetdev_info(netdev, \"Set fc failed on the set_phy_config call with err %d aq_err %s\\n\",\n \t\t\t    err, libie_aq_str(hw-\u003eadminq.sq_last_status));\n \t\terr = -EAGAIN;\n-\t} else if (aq_failures \u0026 ICE_SET_FC_AQ_FAIL_UPDATE) {\n+\t\tbreak;\n+\tcase ICE_SET_FC_AQ_FAIL_UPDATE:\n \t\tnetdev_info(netdev, \"Set fc failed on the get_link_info call with err %d aq_err %s\\n\",\n \t\t\t    err, libie_aq_str(hw-\u003eadminq.sq_last_status));\n \t\terr = -EAGAIN;\n+\t\tbreak;\n \t}\n \n \treturn err;\ndiff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c\nindex e2fbe111f84969..e2fd2dab03e363 100644\n--- a/drivers/net/ethernet/intel/ice/ice_main.c\n+++ b/drivers/net/ethernet/intel/ice/ice_main.c\n@@ -4789,16 +4789,14 @@ static void ice_init_wakeup(struct ice_pf *pf)\n \tdevice_set_wakeup_enable(ice_pf_to_dev(pf), false);\n }\n \n-static int ice_init_link(struct ice_pf *pf)\n+static void ice_init_link(struct ice_pf *pf)\n {\n \tstruct device *dev = ice_pf_to_dev(pf);\n \tint err;\n \n \terr = ice_init_link_events(pf-\u003ehw.port_info);\n-\tif (err) {\n+\tif (err)\n \t\tdev_err(dev, \"ice_init_link_events failed: %d\\n\", err);\n-\t\treturn err;\n-\t}\n \n \t/* not a fatal error if this fails */\n \terr = ice_init_nvm_phy_type(pf-\u003ehw.port_info);\n@@ -4838,8 +4836,6 @@ static int ice_init_link(struct ice_pf *pf)\n \t} else {\n \t\tset_bit(ICE_FLAG_NO_MEDIA, pf-\u003eflags);\n \t}\n-\n-\treturn err;\n }\n \n static int ice_init_pf_sw(struct ice_pf *pf)\n@@ -4982,13 +4978,11 @@ static int ice_init(struct ice_pf *pf)\n \n \tice_init_wakeup(pf);\n \n-\terr = ice_init_link(pf);\n-\tif (err)\n-\t\tgoto err_init_link;\n+\tice_init_link(pf);\n \n \terr = ice_send_version(pf);\n \tif (err)\n-\t\tgoto err_init_link;\n+\t\tgoto err_deinit_pf_sw;\n \n \tice_verify_cacheline_size(pf);\n \n@@ -5007,7 +5001,7 @@ static int ice_init(struct ice_pf *pf)\n \n \treturn 0;\n \n-err_init_link:\n+err_deinit_pf_sw:\n \tice_deinit_pf_sw(pf);\n err_init_pf_sw:\n \tice_dealloc_vsis(pf);\ndiff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c\nindex b1f46707dcc004..27e4acb1620f0c 100644\n--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c\n+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c\n@@ -801,7 +801,7 @@ void ice_reset_all_vfs(struct ice_pf *pf)\n \t\t * setup only when VF creates its first FDIR rule.\n \t\t */\n \t\tif (vf-\u003ectrl_vsi_idx != ICE_NO_VSI)\n-\t\t\tice_vf_ctrl_invalidate_vsi(vf);\n+\t\t\tice_vf_ctrl_vsi_release(vf);\n \n \t\tice_vf_pre_vsi_rebuild(vf);\n \t\tif (ice_vf_rebuild_vsi(vf)) {\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies Intel Ethernet drivers (e1000e, i40e, ice) which require physical PCI hardware to be probed. The e1000e changes are specific to ICH8LAN/PCH MAC types and a DMI quirk, which are not emulated by QEMU (QEMU emulates the 82574L MAC). The i40e change is a trivial debug macro fix. The ice changes are for the Intel E800 series, which lacks software emulation in standard virtualized environments. Since the modified code paths cannot be reached without the specific physical hardware, this patch does not need to be fuzzed.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 54ca21b36f5c088e865f3c5de54ca2ca7cb2f975
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 22 22:14:35 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index dea208db1be5bf..aa90e0ce8acaf8 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1594,6 +1594,9 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 			phy_reg &= ~I217_PLL_CLOCK_GATE_MASK;
 			if (speed == SPEED_100 || speed == SPEED_10)
 				phy_reg |= 0x3E8;
+			else if (hw->mac.type == e1000_pch_mtp ||
+				 hw->mac.type == e1000_pch_ptp)
+				phy_reg |= 0x1D5;
 			else
 				phy_reg |= 0xFA;
 			e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 808e5cddd6a918..844f31ab37ad44 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -25,6 +25,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/prefetch.h>
 #include <linux/suspend.h>
+#include <linux/dmi.h>
 
 #include "e1000.h"
 #define CREATE_TRACE_POINTS
@@ -58,6 +59,17 @@ static const struct e1000_info *e1000_info_tbl[] = {
 	[board_pch_ptp]		= &e1000_pch_ptp_info,
 };
 
+static const struct dmi_system_id disable_k1_list[] = {
+	{
+		.ident = "Dell Pro 16 Plus PB16250",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro 16 Plus PB16250"),
+		},
+	},
+	{}
+};
+
 struct e1000_reg_info {
 	u32 ofs;
 	char *name;
@@ -7670,7 +7682,8 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	/* init PTP hardware clock */
 	e1000e_ptp_init(adapter);
 
-	if (hw->mac.type >= e1000_pch_mtp)
+	/* disable K1 by default on known problematic systems */
+	if (hw->mac.type >= e1000_pch_mtp && dmi_check_system(disable_k1_list))
 		adapter->flags2 |= FLAG2_DISABLE_K1;
 
 	/* reset the hardware with the new settings */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debug.h b/drivers/net/ethernet/intel/i40e/i40e_debug.h
index e9871dfb32bd44..01fd70db908666 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debug.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_debug.h
@@ -42,7 +42,7 @@ struct device *i40e_hw_to_dev(struct i40e_hw *hw);
 #define i40e_debug(h, m, s, ...)				\
 do {								\
 	if (((m) & (h)->debug_mask))				\
-		dev_info(i40e_hw_to_dev(hw), s, ##__VA_ARGS__);	\
+		dev_info(i40e_hw_to_dev(h), s, ##__VA_ARGS__);	\
 } while (0)
 
 #endif /* _I40E_DEBUG_H_ */
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 31e0de9e7f6075..ef1ce106f81b5e 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -3882,7 +3882,6 @@ ice_set_fc(struct ice_port_info *pi, u8 *aq_failures, bool ena_auto_link_update)
 	if (!pi || !aq_failures)
 		return -EINVAL;
 
-	*aq_failures = 0;
 	hw = pi->hw;
 
 	pcaps = kzalloc_obj(*pcaps);
diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c
index 462c69cc11e19d..30c3a4db7d611c 100644
--- a/drivers/net/ethernet/intel/ice/ice_dpll.c
+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c
@@ -4645,9 +4645,13 @@ ice_dpll_init_pins_info(struct ice_pf *pf, enum ice_dpll_pin_type pin_type)
 static void ice_dpll_deinit_info(struct ice_pf *pf)
 {
 	kfree(pf->dplls.inputs);
+	pf->dplls.inputs = NULL;
 	kfree(pf->dplls.outputs);
+	pf->dplls.outputs = NULL;
 	kfree(pf->dplls.eec.input_prio);
+	pf->dplls.eec.input_prio = NULL;
 	kfree(pf->dplls.pps.input_prio);
+	pf->dplls.pps.input_prio = NULL;
 }
 
 /**
@@ -4748,12 +4752,16 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu)
 
 	alloc_size = sizeof(*de->input_prio) * d->num_inputs;
 	de->input_prio = kzalloc(alloc_size, GFP_KERNEL);
-	if (!de->input_prio)
-		return -ENOMEM;
+	if (!de->input_prio) {
+		ret = -ENOMEM;
+		goto deinit_info;
+	}
 
 	dp->input_prio = kzalloc(alloc_size, GFP_KERNEL);
-	if (!dp->input_prio)
-		return -ENOMEM;
+	if (!dp->input_prio) {
+		ret = -ENOMEM;
+		goto deinit_info;
+	}
 
 	ret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_INPUT);
 	if (ret)
@@ -4778,12 +4786,12 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu)
 	ret = ice_get_cgu_rclk_pin_info(&pf->hw, &d->base_rclk_idx,
 					&pf->dplls.rclk.num_parents);
 	if (ret)
-		return ret;
+		goto deinit_info;
 	for (i = 0; i < pf->dplls.rclk.num_parents; i++)
 		pf->dplls.rclk.parent_idx[i] = d->base_rclk_idx + i;
 	ret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_RCLK_INPUT);
 	if (ret)
-		return ret;
+		goto deinit_info;
 	de->mode = DPLL_MODE_AUTOMATIC;
 	dp->mode = DPLL_MODE_AUTOMATIC;
 
diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c
index 2e4f0969035f77..c30e27bbfe6e25 100644
--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c
+++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c
@@ -117,8 +117,6 @@ static int ice_eswitch_setup_repr(struct ice_pf *pf, struct ice_repr *repr)
 	if (!repr->dst)
 		return -ENOMEM;
 
-	netif_keep_dst(uplink_vsi->netdev);
-
 	dst = repr->dst;
 	dst->u.port_info.port_id = vsi->vsi_num;
 	dst->u.port_info.lower_dev = uplink_vsi->netdev;
@@ -312,6 +310,8 @@ static int ice_eswitch_enable_switchdev(struct ice_pf *pf)
 	if (ice_eswitch_br_offloads_init(pf))
 		goto err_br_offloads;
 
+	netif_keep_dst(uplink_vsi->netdev);
+
 	pf->eswitch.is_running = true;
 
 	return 0;
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 236d293aba984a..49371b06584582 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -3508,7 +3508,7 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
 	struct ice_vsi *vsi = np->vsi;
 	struct ice_hw *hw = &pf->hw;
 	struct ice_port_info *pi;
-	u8 aq_failures;
+	u8 aq_failures = 0;
 	bool link_up;
 	u32 is_an;
 	int err;
@@ -3579,18 +3579,22 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
 	/* Set the FC mode and only restart AN if link is up */
 	err = ice_set_fc(pi, &aq_failures, link_up);
 
-	if (aq_failures & ICE_SET_FC_AQ_FAIL_GET) {
+	switch (aq_failures) {
+	case ICE_SET_FC_AQ_FAIL_GET:
 		netdev_info(netdev, "Set fc failed on the get_phy_capabilities call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
-	} else if (aq_failures & ICE_SET_FC_AQ_FAIL_SET) {
+		break;
+	case ICE_SET_FC_AQ_FAIL_SET:
 		netdev_info(netdev, "Set fc failed on the set_phy_config call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
-	} else if (aq_failures & ICE_SET_FC_AQ_FAIL_UPDATE) {
+		break;
+	case ICE_SET_FC_AQ_FAIL_UPDATE:
 		netdev_info(netdev, "Set fc failed on the get_link_info call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
+		break;
 	}
 
 	return err;
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index e2fbe111f84969..e2fd2dab03e363 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4789,16 +4789,14 @@ static void ice_init_wakeup(struct ice_pf *pf)
 	device_set_wakeup_enable(ice_pf_to_dev(pf), false);
 }
 
-static int ice_init_link(struct ice_pf *pf)
+static void ice_init_link(struct ice_pf *pf)
 {
 	struct device *dev = ice_pf_to_dev(pf);
 	int err;
 
 	err = ice_init_link_events(pf->hw.port_info);
-	if (err) {
+	if (err)
 		dev_err(dev, "ice_init_link_events failed: %d\n", err);
-		return err;
-	}
 
 	/* not a fatal error if this fails */
 	err = ice_init_nvm_phy_type(pf->hw.port_info);
@@ -4838,8 +4836,6 @@ static int ice_init_link(struct ice_pf *pf)
 	} else {
 		set_bit(ICE_FLAG_NO_MEDIA, pf->flags);
 	}
-
-	return err;
 }
 
 static int ice_init_pf_sw(struct ice_pf *pf)
@@ -4982,13 +4978,11 @@ static int ice_init(struct ice_pf *pf)
 
 	ice_init_wakeup(pf);
 
-	err = ice_init_link(pf);
-	if (err)
-		goto err_init_link;
+	ice_init_link(pf);
 
 	err = ice_send_version(pf);
 	if (err)
-		goto err_init_link;
+		goto err_deinit_pf_sw;
 
 	ice_verify_cacheline_size(pf);
 
@@ -5007,7 +5001,7 @@ static int ice_init(struct ice_pf *pf)
 
 	return 0;
 
-err_init_link:
+err_deinit_pf_sw:
 	ice_deinit_pf_sw(pf);
 err_init_pf_sw:
 	ice_dealloc_vsis(pf);
diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
index b1f46707dcc004..27e4acb1620f0c 100644
--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
@@ -801,7 +801,7 @@ void ice_reset_all_vfs(struct ice_pf *pf)
 		 * setup only when VF creates its first FDIR rule.
 		 */
 		if (vf->ctrl_vsi_idx != ICE_NO_VSI)
-			ice_vf_ctrl_invalidate_vsi(vf);
+			ice_vf_ctrl_vsi_release(vf);
 
 		ice_vf_pre_vsi_rebuild(vf);
 		if (ice_vf_rebuild_vsi(vf)) {

gemini-3.1-pro-preview

null

null

							input: 5959
							output: 172
							thoughts: 1647
						

**Analysis of Intel Ethernet Driver Patch Series**

Okay, let's break this down. We have a patch series touching the `e1000e`, `i40e`, and `ice` Intel Ethernet drivers. My initial thought is to assess the fuzzing potential.

First, `e1000e`: The patch modifies `ich8lan.c`, specifically related to PHY/MAC configurations for certain Intel PCH MAC types like `e1000_pch_mtp` and `e1000_pch_ptp`. This immediately raises a flag: `e1000e` is a physical hardware driver. The question is, can we trigger these specific code paths in a virtualized environment? QEMU offers emulation for `e1000` and `e1000e`, which is useful, but which MAC is it emulating? Further digging reveals that QEMU's `e1000e` emulation defaults to the 82574L. These changes in `ich8lan.c` are for the ICH8/9/10, PCH, PCH2, LPT, SPT, CNP, etc. MAC types, which are *not* emulated by QEMU. Additionally, a DMI check is being added to `netdev.c` for a Dell Pro laptop, which is not reachable through generic fuzzing unless we mock the DMI, but that's not our current focus.

Moving to `i40e`, the changes are minimal, just a debug macro fix in `i40e_debug.h`.

The `ice` driver changes are more numerous, involving flow control, DPLL initialization/de-initialization, eswitch setup, ethtool integration, initialization, and VF management. Again, we are looking at hardware-specific functionality of the E800 series.

My immediate question is whether we can reach these via a virtualized environment. QEMU does *not* natively emulate `i40e` or `ice`. It does have the ability to emulate the `igb` driver (82576), which can be useful, but that's not what is being modified here. I am also aware there is no known software emulation for `ice` or `i40e` available that I am familiar with.

To reach the code, we need the PCI device, otherwise the `probe` function will never be called. We can't reach this code through some mock. For example, to call `ice_set_pauseparam`, we need the netdev to be registered by the `ice` driver, which means we must have a PCI device.

Specifically, the `e1000e` changes are related to Meteor Lake, which QEMU is definitely not emulating. `ice` is related to Intel E800 series hardware.

Therefore, because all the modified code paths require specific physical hardware that is not emulated in virtualized environments like QEMU, this patch series is not suitable for fuzzing. Thus, `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies Intel Ethernet drivers (e1000e, i40e, ice) which require physical PCI hardware to be probed. The e1000e changes are specific to ICH8LAN/PCH MAC types and a DMI quirk, which are not emulated by QEMU (QEMU emulates the 82574L MAC). The i40e change is a trivial debug macro fix. The ice changes are for the Intel E800 series, which lacks software emulation in standard virtualized environments. Since the modified code paths cannot be reached without the specific physical hardware, this patch does not need to be fuzzed.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies Intel Ethernet drivers (e1000e, i40e, ice) which require physical PCI hardware to be probed. The e1000e changes are specific to ICH8LAN/PCH MAC types and a DMI quirk, which are not emulated by QEMU (QEMU emulates the 82574L MAC). The i40e change is a trivial debug macro fix. The ice changes are for the Intel E800 series, which lacks software emulation in standard virtualized environments. Since the modified code paths cannot be reached without the specific physical hardware, this patch does not need to be fuzzed.",
  "WorthFuzzing": false
}