AI Trajectory

null

{
  "EnableConfigs": [
    "INET",
    "IPV6"
  ],
  "FocusSymbols": [
    "ip_cmsg_recv_offset"
  ],
  "KMSANReasoning": "The patch adds a check `ip_hdr(skb)-\u003eversion != IPVERSION` at the entry of `ip_cmsg_recv_offset()` to return early if the packet is not an IPv4 packet (e.g. when processing dual-stack or IPv6 skbs).\n\nThis change only adds an early return validation check on the packet header version. It does not introduce any new stack/heap allocations, does not modify data lengths or structure initialization, and does not expose or read uninitialized memory. Standard testing with KASAN is sufficient, and a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch adds a validation check in ip_cmsg_recv_offset() to verify that the IP header version matches IPVERSION (IPv4) before parsing IPv4 control messages (cmsg) from the skb. This affects socket recvmsg processing across IPv4 and dual-stack IPv6 sockets and prevents malformed or cross-protocol header misinterpretation.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 94a5eec156fdfcd60ececec7485d73cceb4e45f5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Aug 29 15:44:37 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c\nindex a55ef327ec932..01d264e8f34ea 100644\n--- a/net/ipv4/ip_sockglue.c\n+++ b/net/ipv4/ip_sockglue.c\n@@ -174,6 +174,9 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\n \tif (!flags)\n \t\treturn;\n \n+\tif (unlikely(ip_hdr(skb)-\u003eversion != IPVERSION))\n+\t\treturn;\n+\n \t/* Ordered by supposed usage frequency */\n \tif (flags \u0026 IP_CMSG_PKTINFO) {\n \t\tip_cmsg_recv_pktinfo(msg, skb);\n"
}

core

null

{
  "EnableConfigs": [
    "INET",
    "IPV6"
  ],
  "FocusSymbols": [
    "ip_cmsg_recv_offset"
  ],
  "Reasoning": "The patch adds a validation check in ip_cmsg_recv_offset() to verify that the IP header version matches IPVERSION (IPv4) before parsing IPv4 control messages (cmsg) from the skb. This affects socket recvmsg processing across IPv4 and dual-stack IPv6 sockets and prevents malformed or cross-protocol header misinterpretation.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 94a5eec156fdfcd60ececec7485d73cceb4e45f5
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Aug 29 15:44:37 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index a55ef327ec932..01d264e8f34ea 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -174,6 +174,9 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,
 	if (!flags)
 		return;
 
+	if (unlikely(ip_hdr(skb)->version != IPVERSION))
+		return;
+
 	/* Ordered by supposed usage frequency */
 	if (flags & IP_CMSG_PKTINFO) {
 		ip_cmsg_recv_pktinfo(msg, skb);

gemini-3.7-flash

null

null

							input: 2082
							output: 39
							thoughts: 288
						

**Analyzing the Network Socket Glue Code**

Okay, let's dive in. I need to understand this patch, so I'm focusing on the code and its context. The diff shows a modification to `net/ipv4/ip_sockglue.c`, specifically around the `ip_cmsg_recv_offset` function. The key change is the addition of a check: `if (unlikely(ip_hdr(skb)->version != IPVERSION)) return;`. My initial thought is this is a crucial security or stability measure related to IPv4 packet handling, probably designed to avoid processing malformed packets. It's a conditional check on the IP header version, ensuring it's the expected version (`IPVERSION`, presumably 4). This suggests a potential vulnerability or error condition was addressed where an incorrectly formatted IP packet was somehow getting through.

I should probably refresh my memory of `ip_cmsg_recv_offset`. I need to understand what `ip_cmsg_recv_offset` does and how it's used to fully grasp the significance of this check. I need to look at the surrounding code and callers of this function. I'll check its interaction with other control message flags like `IP_CMSG_PKTINFO`. I'm guessing that this new check prevents some sort of unexpected behavior, like a crash, or an information leak, if an invalid packet with a non-IPv4 IP version were somehow received by the socket. So, the goal is to see what kind of damage could be caused by bad packets making their way into the system.

{
  "File": "net/ipv4/ip_sockglue.c",
  "FirstLine": 160,
  "LineCount": 50
}

{
  "Contents": " 160:\t\n 161:\t\tsin.sin_family = AF_INET;\n 162:\t\tsin.sin_addr.s_addr = ip_hdr(skb)-\u003edaddr;\n 163:\t\tsin.sin_port = ports[1];\n 164:\t\tmemset(sin.sin_zero, 0, sizeof(sin.sin_zero));\n 165:\t\n 166:\t\tput_cmsg(msg, SOL_IP, IP_ORIGDSTADDR, sizeof(sin), \u0026sin);\n 167:\t}\n 168:\t\n 169:\tvoid ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\n 170:\t\t\t\t struct sk_buff *skb, int tlen, int offset)\n 171:\t{\n 172:\t\tunsigned long flags = inet_cmsg_flags(inet_sk(sk));\n 173:\t\n 174:\t\tif (!flags)\n 175:\t\t\treturn;\n 176:\t\n 177:\t\tif (unlikely(ip_hdr(skb)-\u003eversion != IPVERSION))\n 178:\t\t\treturn;\n 179:\t\n 180:\t\t/* Ordered by supposed usage frequency */\n 181:\t\tif (flags \u0026 IP_CMSG_PKTINFO) {\n 182:\t\t\tip_cmsg_recv_pktinfo(msg, skb);\n 183:\t\n 184:\t\t\tflags \u0026= ~IP_CMSG_PKTINFO;\n 185:\t\t\tif (!flags)\n 186:\t\t\t\treturn;\n 187:\t\t}\n 188:\t\n 189:\t\tif (flags \u0026 IP_CMSG_TTL) {\n 190:\t\t\tip_cmsg_recv_ttl(msg, skb);\n 191:\t\n 192:\t\t\tflags \u0026= ~IP_CMSG_TTL;\n 193:\t\t\tif (!flags)\n 194:\t\t\t\treturn;\n 195:\t\t}\n 196:\t\n 197:\t\tif (flags \u0026 IP_CMSG_TOS) {\n 198:\t\t\tip_cmsg_recv_tos(msg, skb);\n 199:\t\n 200:\t\t\tflags \u0026= ~IP_CMSG_TOS;\n 201:\t\t\tif (!flags)\n 202:\t\t\t\treturn;\n 203:\t\t}\n 204:\t\n 205:\t\tif (flags \u0026 IP_CMSG_RECVOPTS) {\n 206:\t\t\tip_cmsg_recv_opts(msg, skb);\n 207:\t\n 208:\t\t\tflags \u0026= ~IP_CMSG_RECVOPTS;\n 209:\t\t\tif (!flags)\n"
}

gemini-3.7-flash

null

null

							input: 3455
							output: 20
							thoughts: 25
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into `ip_cmsg_recv_offset`**

Okay, so I need to understand how `ip_cmsg_recv_offset` is functioning. My first instinct is to trace the call graph. I want to see where this function is invoked and then, crucially, what it's being used for. Is it handling ancillary data? Are we dealing with IP options, or something more specialized? The context is key here. Understanding the purpose will inform my assumptions around potential bugs, performance bottlenecks or areas for future optimization. Let's start with a quick code search and see what the immediate landscape looks like.

{
  "Expression": "ip_cmsg_recv"
}

{
  "Output": "include/net/ip.h=815=void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb, bool drop_dst);\ninclude/net/ip.h:816:void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\ninclude/net/ip.h-817-\t\t\t struct sk_buff *skb, int tlen, int offset);\n--\ninclude/net/ip.h=835=void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,\n--\ninclude/net/ip.h-837-\ninclude/net/ip.h:838:static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)\ninclude/net/ip.h-839-{\ninclude/net/ip.h:840:\tip_cmsg_recv_offset(msg, skb-\u003esk, skb, 0, 0);\ninclude/net/ip.h-841-}\n--\nnet/ipv4/ip_sockglue.c-53-\nnet/ipv4/ip_sockglue.c:54:static void ip_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-55-{\n--\nnet/ipv4/ip_sockglue.c-62-\nnet/ipv4/ip_sockglue.c:63:static void ip_cmsg_recv_ttl(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-64-{\n--\nnet/ipv4/ip_sockglue.c-68-\nnet/ipv4/ip_sockglue.c:69:static void ip_cmsg_recv_tos(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-70-{\n--\nnet/ipv4/ip_sockglue.c-73-\nnet/ipv4/ip_sockglue.c:74:static void ip_cmsg_recv_opts(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-75-{\n--\nnet/ipv4/ip_sockglue.c-83-\nnet/ipv4/ip_sockglue.c:84:static void ip_cmsg_recv_retopts(struct net *net, struct msghdr *msg,\nnet/ipv4/ip_sockglue.c-85-\t\t\t\t struct sk_buff *skb)\n--\nnet/ipv4/ip_sockglue.c-101-\nnet/ipv4/ip_sockglue.c:102:static void ip_cmsg_recv_fragsize(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-103-{\n--\nnet/ipv4/ip_sockglue.c-112-\nnet/ipv4/ip_sockglue.c:113:static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,\nnet/ipv4/ip_sockglue.c-114-\t\t\t\t  int tlen, int offset)\n--\nnet/ipv4/ip_sockglue.c-128-\nnet/ipv4/ip_sockglue.c:129:static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-130-{\n--\nnet/ipv4/ip_sockglue.c-146-\nnet/ipv4/ip_sockglue.c:147:static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)\nnet/ipv4/ip_sockglue.c-148-{\n--\nnet/ipv4/ip_sockglue.c-168-\nnet/ipv4/ip_sockglue.c:169:void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\nnet/ipv4/ip_sockglue.c-170-\t\t\t struct sk_buff *skb, int tlen, int offset)\n--\nnet/ipv4/ip_sockglue.c-181-\tif (flags \u0026 IP_CMSG_PKTINFO) {\nnet/ipv4/ip_sockglue.c:182:\t\tip_cmsg_recv_pktinfo(msg, skb);\nnet/ipv4/ip_sockglue.c-183-\n--\nnet/ipv4/ip_sockglue.c-189-\tif (flags \u0026 IP_CMSG_TTL) {\nnet/ipv4/ip_sockglue.c:190:\t\tip_cmsg_recv_ttl(msg, skb);\nnet/ipv4/ip_sockglue.c-191-\n--\nnet/ipv4/ip_sockglue.c-197-\tif (flags \u0026 IP_CMSG_TOS) {\nnet/ipv4/ip_sockglue.c:198:\t\tip_cmsg_recv_tos(msg, skb);\nnet/ipv4/ip_sockglue.c-199-\n--\nnet/ipv4/ip_sockglue.c-205-\tif (flags \u0026 IP_CMSG_RECVOPTS) {\nnet/ipv4/ip_sockglue.c:206:\t\tip_cmsg_recv_opts(msg, skb);\nnet/ipv4/ip_sockglue.c-207-\n--\nnet/ipv4/ip_sockglue.c-213-\tif (flags \u0026 IP_CMSG_RETOPTS) {\nnet/ipv4/ip_sockglue.c:214:\t\tip_cmsg_recv_retopts(sock_net(sk), msg, skb);\nnet/ipv4/ip_sockglue.c-215-\n--\nnet/ipv4/ip_sockglue.c-221-\tif (flags \u0026 IP_CMSG_PASSSEC) {\nnet/ipv4/ip_sockglue.c:222:\t\tip_cmsg_recv_security(msg, skb);\nnet/ipv4/ip_sockglue.c-223-\n--\nnet/ipv4/ip_sockglue.c-229-\tif (flags \u0026 IP_CMSG_ORIGDSTADDR) {\nnet/ipv4/ip_sockglue.c:230:\t\tip_cmsg_recv_dstaddr(msg, skb);\nnet/ipv4/ip_sockglue.c-231-\n--\nnet/ipv4/ip_sockglue.c-237-\tif (flags \u0026 IP_CMSG_CHECKSUM)\nnet/ipv4/ip_sockglue.c:238:\t\tip_cmsg_recv_checksum(msg, skb, tlen, offset);\nnet/ipv4/ip_sockglue.c-239-\nnet/ipv4/ip_sockglue.c-240-\tif (flags \u0026 IP_CMSG_RECVFRAGSIZE)\nnet/ipv4/ip_sockglue.c:241:\t\tip_cmsg_recv_fragsize(msg, skb);\nnet/ipv4/ip_sockglue.c-242-}\nnet/ipv4/ip_sockglue.c:243:EXPORT_SYMBOL(ip_cmsg_recv_offset);\nnet/ipv4/ip_sockglue.c-244-\n--\nnet/ipv4/ip_sockglue.c=526=int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)\n--\nnet/ipv4/ip_sockglue.c-573-\t\tif (inet_cmsg_flags(inet_sk(sk)))\nnet/ipv4/ip_sockglue.c:574:\t\t\tip_cmsg_recv(msg, skb);\nnet/ipv4/ip_sockglue.c-575-\t}\n--\nnet/ipv4/ping.c=842=int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags)\n--\nnet/ipv4/ping.c-888-\t\tif (inet_cmsg_flags(isk))\nnet/ipv4/ping.c:889:\t\t\tip_cmsg_recv(msg, skb);\nnet/ipv4/ping.c-890-\n--\nnet/ipv4/ping.c-915-\t\t\t inet_cmsg_flags(isk))\nnet/ipv4/ping.c:916:\t\t\tip_cmsg_recv(msg, skb);\nnet/ipv4/ping.c-917-#endif\n--\nnet/ipv4/raw.c=749=static int raw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,\n--\nnet/ipv4/raw.c-790-\tif (inet_cmsg_flags(inet))\nnet/ipv4/raw.c:791:\t\tip_cmsg_recv(msg, skb);\nnet/ipv4/raw.c-792-\tif (flags \u0026 MSG_TRUNC)\n--\nnet/ipv4/udp.c=2033=int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags)\n--\nnet/ipv4/udp.c-2111-\tif (inet_cmsg_flags(inet))\nnet/ipv4/udp.c:2112:\t\tip_cmsg_recv_offset(msg, sk, skb, sizeof(struct udphdr), off);\nnet/ipv4/udp.c-2113-\n--\nnet/ipv6/datagram.c=455=int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)\n--\nnet/ipv6/datagram.c-527-\t\t\tif (inet_cmsg_flags(inet_sk(sk)))\nnet/ipv6/datagram.c:528:\t\t\t\tip_cmsg_recv(msg, skb);\nnet/ipv6/datagram.c-529-\t\t}\n--\nnet/ipv6/udp.c=464=int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,\n--\nnet/ipv6/udp.c-561-\t\tif (inet_cmsg_flags(inet))\nnet/ipv6/udp.c:562:\t\t\tip_cmsg_recv_offset(msg, sk, skb,\nnet/ipv6/udp.c-563-\t\t\t\t\t    sizeof(struct udphdr), off);\n--\nnet/l2tp/l2tp_ip.c=539=static int l2tp_ip_recvmsg(struct sock *sk, struct msghdr *msg,\n--\nnet/l2tp/l2tp_ip.c-575-\tif (inet_cmsg_flags(inet))\nnet/l2tp/l2tp_ip.c:576:\t\tip_cmsg_recv(msg, skb);\nnet/l2tp/l2tp_ip.c-577-\tif (flags \u0026 MSG_TRUNC)\n--\nnet/sunrpc/svcsock.c=482=static void svc_tcp_handshake(struct svc_xprt *xprt)\n--\nnet/sunrpc/svcsock.c-543-/*\nnet/sunrpc/svcsock.c:544: * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo\nnet/sunrpc/svcsock.c-545- */\n"
}

gemini-3.7-flash

null

null

							input: 6580
							output: 30
							thoughts: 558
						

**Analyzing a Core Networking Fix**

Okay, let's break this down. First, this code snippet checks the IP version of a received `skb` (socket buffer). The goal is to avoid issues when processing control messages (cmsgs) on sockets that might be receiving IPv6 packets, or malformed packets. The specific line, `if (unlikely(ip_hdr(skb)->version != IPVERSION)) return;`, is the key. It seems like someone added this check to prevent accessing IPv4 header fields (like source/destination address, TTL, TOS) on an `skb` that *isn't* actually an IPv4 packet. Accessing these fields on a non-IPv4 packet could lead to crashes or, at best, incorrect interpretation of data.

Given my expertise, this is clearly a critical fix within the networking stack. `ip_cmsg_recv_offset` which does the cmsg processing, is called during `recvmsg` when control messages are enabled on sockets and handles the core logic for IPv4/IPv6 socket cmsg processing.

Let's quickly assess its fuzzability. Is it core networking? Yep, `net/ipv4/ip_sockglue.c`. Is it reachable? Absolutely, standard `AF_INET`/`AF_INET6` sockets using `recvmsg` with cmsg flags like `IP_PKTINFO`, `IP_TTL`, etc. Is it worth fuzzing? Definitely. This change directly addresses potential memory access violations or cross-protocol cmsg parsing errors. These are the kinds of vulnerabilities that fuzzing excels at uncovering.

Now, let's zero in on `ip_cmsg_recv_offset`. It's exported, so it's accessible. It's called during `recvmsg` with cmsg options enabled on the socket. Specifically, it's called by `ip_recv_error`, `udpv6_recvmsg`, `udp_recvmsg`, `raw_recvmsg`, `ping_recvmsg`. And critically, it is the *exact* function that was modified. This makes it a high-priority target. I will check the Kconfig dependencies for `net/ipv4/ip_sockglue.c` to see if there are any specific configurations that need to be in place.

{
  "Expression": "ip_sockglue\\.o",
  "PathPrefix": "net/ipv4"
}

{
  "Output": "net/ipv4/Makefile=6=obj-y     := route.o inetpeer.o protocol.o \\\nnet/ipv4/Makefile-7-\t     ip_input.o ip_fragment.o ip_forward.o ip_options.o \\\nnet/ipv4/Makefile:8:\t     ip_output.o ip_sockglue.o inet_hashtables.o \\\nnet/ipv4/Makefile-9-\t     inet_timewait_sock.o inet_connection_sock.o \\\n"
}

gemini-3.7-flash

null

null

							input: 7783
							output: 24
							thoughts: 35
						

Here's my thought process, as it relates to that build process:

**Diving into the Kernel Build System**

Okay, so `ip_sockglue.o` is being built. That's a key part of the IPv4 networking stack, so I need to understand *how* it's being built. The build system tells me it's linked in via `obj-y` in `net/ipv4/Makefile`. That means it's statically compiled into the IPv4 module. Now, I need to see *where* `net/ipv4/Makefile` is included in the larger build. Let me jump back up the hierarchy and examine `net/Makefile`. I need to figure out the build dependencies. This is where the magic happens and the larger network stack build logic is implemented. I need to trace this back to the root make file if I want to have a holistic picture of the build order and dependencies.

{
  "Expression": "ipv4",
  "PathPrefix": "net/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 9298 lines.\nUse more precise expression if possible.\n\nnet/Kconfig=114=config INET\n--\nnet/Kconfig-130-\t  behavior of the TCP/IP code by writing to the (virtual) files in\nnet/Kconfig:131:\t  /proc/sys/net/ipv4/*; the options are explained in the file\nnet/Kconfig-132-\t  \u003cfile:Documentation/networking/ip-sysctl.rst\u003e.\n--\nnet/Kconfig=136=if INET\nnet/Kconfig:137:source \"net/ipv4/Kconfig\"\nnet/Kconfig-138-source \"net/ipv6/Kconfig\"\n--\nnet/Kconfig=247=source \"net/netfilter/Kconfig\"\nnet/Kconfig:248:source \"net/ipv4/netfilter/Kconfig\"\nnet/Kconfig-249-source \"net/ipv6/netfilter/Kconfig\"\n--\nnet/Makefile=16=obj-$(CONFIG_NETFILTER)\t\t+= netfilter/\nnet/Makefile:17:obj-$(CONFIG_INET)\t\t+= ipv4/\nnet/Makefile-18-obj-$(CONFIG_TLS)\t\t+= tls/\n--\nnet/atm/br2684.c=33=static void skb_debug(const struct sk_buff *skb)\n--\nnet/atm/br2684.c-52-\nnet/atm/br2684.c:53:static const unsigned char ethertype_ipv4[] = { ETHERTYPE_IPV4 };\nnet/atm/br2684.c-54-static const unsigned char ethertype_ipv6[] = { ETHERTYPE_IPV6 };\n--\nnet/atm/br2684.c=57=static const unsigned char pad[] = { PAD_BRIDGED };\nnet/atm/br2684.c:58:static const unsigned char llc_oui_ipv4[] = { LLC, SNAP_ROUTED, ETHERTYPE_IPV4 };\nnet/atm/br2684.c-59-static const unsigned char llc_oui_ipv6[] = { LLC, SNAP_ROUTED, ETHERTYPE_IPV6 };\n--\nnet/atm/br2684.c=202=static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,\n--\nnet/atm/br2684.c-208-\t\t((brdev-\u003epayload == p_bridged) ?\nnet/atm/br2684.c:209:\t\t\tsizeof(llc_oui_pid_pad) : sizeof(llc_oui_ipv4)) :\nnet/atm/br2684.c-210-\t\t((brdev-\u003epayload == p_bridged) ? BR2684_PAD_LEN : 0);\n--\nnet/atm/br2684.c-230-\nnet/atm/br2684.c:231:\t\t\tskb_push(skb, sizeof(llc_oui_ipv4));\nnet/atm/br2684.c-232-\t\t\tswitch (prot) {\nnet/atm/br2684.c-233-\t\t\tcase ETH_P_IP:\nnet/atm/br2684.c:234:\t\t\t\tskb_copy_to_linear_data(skb, llc_oui_ipv4,\nnet/atm/br2684.c:235:\t\t\t\t\t\t\tsizeof(llc_oui_ipv4));\nnet/atm/br2684.c-236-\t\t\t\tbreak;\n--\nnet/atm/br2684.c=422=static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)\n--\nnet/atm/br2684.c-451-\t\t/* accept packets that have \"ipv[46]\" in the snap header */\nnet/atm/br2684.c:452:\t\tif ((skb-\u003elen \u003e= (sizeof(llc_oui_ipv4))) \u0026\u0026\nnet/atm/br2684.c:453:\t\t    (memcmp(skb-\u003edata, llc_oui_ipv4,\nnet/atm/br2684.c:454:\t\t\t    sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {\nnet/atm/br2684.c-455-\t\t\tif (memcmp(skb-\u003edata + 6, ethertype_ipv6,\n--\nnet/atm/br2684.c-457-\t\t\t\tskb-\u003eprotocol = htons(ETH_P_IPV6);\nnet/atm/br2684.c:458:\t\t\telse if (memcmp(skb-\u003edata + 6, ethertype_ipv4,\nnet/atm/br2684.c:459:\t\t\t\t\tsizeof(ethertype_ipv4)) == 0)\nnet/atm/br2684.c-460-\t\t\t\tskb-\u003eprotocol = htons(ETH_P_IP);\n--\nnet/atm/br2684.c-462-\t\t\t\tgoto error;\nnet/atm/br2684.c:463:\t\t\tskb_pull(skb, sizeof(llc_oui_ipv4));\nnet/atm/br2684.c-464-\t\t\tskb_reset_network_header(skb);\n--\nnet/atm/br2684.c=645=static void br2684_setup_routed(struct net_device *netdev)\n--\nnet/atm/br2684.c-649-\tbrdev-\u003enet_dev = netdev;\nnet/atm/br2684.c:650:\tnetdev-\u003ehard_header_len = sizeof(llc_oui_ipv4); /* worst case */\nnet/atm/br2684.c-651-\tnetdev-\u003enetdev_ops = \u0026br2684_netdev_ops_routed;\n--\nnet/batman-adv/distributed-arp-table.c=399=batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip,\n--\nnet/batman-adv/distributed-arp-table.c-439- * @bat_priv: the bat priv with all the mesh interface information\nnet/batman-adv/distributed-arp-table.c:440: * @ip: ipv4 to add/edit\nnet/batman-adv/distributed-arp-table.c:441: * @mac_addr: mac address to assign to the given ipv4\nnet/batman-adv/distributed-arp-table.c-442- * @vid: VLAN identifier\n--\nnet/batman-adv/distributed-arp-table.c=639=static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/distributed-arp-table.c-698- * @bat_priv: the bat priv with all the mesh interface information\nnet/batman-adv/distributed-arp-table.c:699: * @ip_dst: ipv4 to look up in the DHT\nnet/batman-adv/distributed-arp-table.c-700- * @vid: VLAN identifier\n--\nnet/batman-adv/distributed-arp-table.c=1082=static u16 batadv_arp_get_type(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/distributed-arp-table.c-1126-\tip_dst = batadv_arp_ip_dst(skb, hdr_size);\nnet/batman-adv/distributed-arp-table.c:1127:\tif (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||\nnet/batman-adv/distributed-arp-table.c:1128:\t    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||\nnet/batman-adv/distributed-arp-table.c:1129:\t    ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||\nnet/batman-adv/distributed-arp-table.c:1130:\t    ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))\nnet/batman-adv/distributed-arp-table.c-1131-\t\tgoto out;\n--\nnet/batman-adv/main.c=189=int batadv_mesh_init(struct net_device *mesh_iface)\n--\nnet/batman-adv/main.c-215-\tINIT_HLIST_HEAD(\u0026bat_priv-\u003emcast.want_all_unsnoopables_list);\nnet/batman-adv/main.c:216:\tINIT_HLIST_HEAD(\u0026bat_priv-\u003emcast.want_all_ipv4_list);\nnet/batman-adv/main.c-217-\tINIT_HLIST_HEAD(\u0026bat_priv-\u003emcast.want_all_ipv6_list);\n--\nnet/batman-adv/main.c=392=void batadv_skb_set_priority(struct sk_buff *skb, int offset)\n--\nnet/batman-adv/main.c-425-\t\t\treturn;\nnet/batman-adv/main.c:426:\t\tprio = (ipv4_get_dsfield(ip_hdr) \u0026 0xfc) \u003e\u003e 5;\nnet/batman-adv/main.c-427-\t\tbreak;\n--\nnet/batman-adv/mesh-interface.c=791=static int batadv_meshif_init_late(struct net_device *dev)\n--\nnet/batman-adv/mesh-interface.c-821-\tatomic_set(\u0026bat_priv-\u003emcast.num_want_all_unsnoopables, 0);\nnet/batman-adv/mesh-interface.c:822:\tatomic_set(\u0026bat_priv-\u003emcast.num_want_all_ipv4, 0);\nnet/batman-adv/mesh-interface.c-823-\tatomic_set(\u0026bat_priv-\u003emcast.num_want_all_ipv6, 0);\n--\nnet/batman-adv/multicast.c=84=static struct net_device *batadv_mcast_get_bridge(struct net_device *mesh_iface)\n--\nnet/batman-adv/multicast.c-99-/**\nnet/batman-adv/multicast.c:100: * batadv_mcast_mla_rtr_flags_meshif_get_ipv4() - get mcast router flags from\nnet/batman-adv/multicast.c-101- *  node for IPv4\n--\nnet/batman-adv/multicast.c-109- */\nnet/batman-adv/multicast.c:110:static u8 batadv_mcast_mla_rtr_flags_meshif_get_ipv4(struct net_device *dev)\nnet/batman-adv/multicast.c-111-{\n--\nnet/batman-adv/multicast.c=164=static u8 batadv_mcast_mla_rtr_flags_meshif_get(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-171-\nnet/batman-adv/multicast.c:172:\tflags |= batadv_mcast_mla_rtr_flags_meshif_get_ipv4(dev);\nnet/batman-adv/multicast.c-173-\tflags |= batadv_mcast_mla_rtr_flags_meshif_get_ipv6(dev);\n--\nnet/batman-adv/multicast.c=274=batadv_mcast_mla_flags_get(struct batadv_priv *bat_priv)\n--\nnet/batman-adv/multicast.c-295-\tmla_flags.bridged = 1;\nnet/batman-adv/multicast.c:296:\tqr4 = \u0026mla_flags.querier_ipv4;\nnet/batman-adv/multicast.c-297-\tqr6 = \u0026mla_flags.querier_ipv6;\n--\nnet/batman-adv/multicast.c=340=static bool batadv_mcast_mla_is_duplicate(u8 *mcast_addr,\n--\nnet/batman-adv/multicast.c-352-/**\nnet/batman-adv/multicast.c:353: * batadv_mcast_mla_meshif_get_ipv4() - get meshif IPv4 multicast listeners\nnet/batman-adv/multicast.c-354- * @dev: the device to collect multicast addresses from\n--\nnet/batman-adv/multicast.c=366=static int\nnet/batman-adv/multicast.c:367:batadv_mcast_mla_meshif_get_ipv4(struct net_device *dev,\nnet/batman-adv/multicast.c-368-\t\t\t\t struct hlist_head *mcast_list,\n--\nnet/batman-adv/multicast.c-390-\t\tif (flags-\u003etvlv_flags \u0026 BATADV_MCAST_WANT_ALL_UNSNOOPABLES \u0026\u0026\nnet/batman-adv/multicast.c:391:\t\t    ipv4_is_local_multicast(pmc-\u003emultiaddr))\nnet/batman-adv/multicast.c-392-\t\t\tcontinue;\n--\nnet/batman-adv/multicast.c-394-\t\tif (!(flags-\u003etvlv_flags \u0026 BATADV_MCAST_WANT_NO_RTR4) \u0026\u0026\nnet/batman-adv/multicast.c:395:\t\t    !ipv4_is_local_multicast(pmc-\u003emultiaddr))\nnet/batman-adv/multicast.c-396-\t\t\tcontinue;\n--\nnet/batman-adv/multicast.c=520=batadv_mcast_mla_meshif_get(struct net_device *dev,\n--\nnet/batman-adv/multicast.c-530-\nnet/batman-adv/multicast.c:531:\tret4 = batadv_mcast_mla_meshif_get_ipv4(dev, mcast_list, flags);\nnet/batman-adv/multicast.c-532-\tif (ret4 \u003c 0)\n--\nnet/batman-adv/multicast.c=585=static int batadv_mcast_mla_bridge_get(struct net_device *dev,\n--\nnet/batman-adv/multicast.c-609-\t\t\tif (tvlv_flags \u0026 BATADV_MCAST_WANT_ALL_UNSNOOPABLES \u0026\u0026\nnet/batman-adv/multicast.c:610:\t\t\t    ipv4_is_local_multicast(br_ip_entry-\u003eaddr.dst.ip4))\nnet/batman-adv/multicast.c-611-\t\t\t\tcontinue;\n--\nnet/batman-adv/multicast.c-613-\t\t\tif (!(tvlv_flags \u0026 BATADV_MCAST_WANT_NO_RTR4) \u0026\u0026\nnet/batman-adv/multicast.c:614:\t\t\t    !ipv4_is_local_multicast(br_ip_entry-\u003eaddr.dst.ip4))\nnet/batman-adv/multicast.c-615-\t\t\t\tcontinue;\n--\nnet/batman-adv/multicast.c=807=batadv_mcast_bridge_log(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-820-\t\tbatadv_mcast_querier_log(bat_priv, \"IGMP\",\nnet/batman-adv/multicast.c:821:\t\t\t\t\t \u0026old_flags-\u003equerier_ipv4,\nnet/batman-adv/multicast.c:822:\t\t\t\t\t \u0026new_flags-\u003equerier_ipv4);\nnet/batman-adv/multicast.c-823-\t\tbatadv_mcast_querier_log(bat_priv, \"MLD\",\n--\nnet/batman-adv/multicast.c=939=static void batadv_mcast_mla_update(struct work_struct *work)\n--\nnet/batman-adv/multicast.c-953-/**\nnet/batman-adv/multicast.c:954: * batadv_mcast_is_report_ipv4() - check for IGMP reports\nnet/batman-adv/multicast.c-955- * @skb: the ethernet frame destined for the mesh\n--\nnet/batman-adv/multicast.c-965- */\nnet/batman-adv/multicast.c:966:static bool batadv_mcast_is_report_ipv4(struct sk_buff *skb)\nnet/batman-adv/multicast.c-967-{\n--\nnet/batman-adv/multicast.c-981-/**\nnet/batman-adv/multicast.c:982: * batadv_mcast_forw_mode_check_ipv4() - check for optimized forwarding\nnet/batman-adv/multicast.c-983- *  potential\n--\nnet/batman-adv/multicast.c-994- */\nnet/batman-adv/multicast.c:995:static int batadv_mcast_forw_mode_check_ipv4(struct batadv_priv *bat_priv,\nnet/batman-adv/multicast.c-996-\t\t\t\t\t     struct sk_buff *skb,\n--\nnet/batman-adv/multicast.c-1005-\nnet/batman-adv/multicast.c:1006:\tif (batadv_mcast_is_report_ipv4(skb))\nnet/batman-adv/multicast.c-1007-\t\treturn -EINVAL;\n--\nnet/batman-adv/multicast.c-1013-\t */\nnet/batman-adv/multicast.c:1014:\tif (ipv4_is_local_multicast(iphdr-\u003edaddr))\nnet/batman-adv/multicast.c-1015-\t\t*is_unsnoopable = true;\n--\nnet/batman-adv/multicast.c=1104=static int batadv_mcast_forw_mode_check(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-1115-\tcase ETH_P_IP:\nnet/batman-adv/multicast.c:1116:\t\treturn batadv_mcast_forw_mode_check_ipv4(bat_priv, skb,\nnet/batman-adv/multicast.c-1117-\t\t\t\t\t\t\t is_unsnoopable,\n--\nnet/batman-adv/multicast.c=1141=static int batadv_mcast_forw_want_all_ip_count(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-1145-\tcase ETH_P_IP:\nnet/batman-adv/multicast.c:1146:\t\treturn atomic_read(\u0026bat_priv-\u003emcast.num_want_all_ipv4);\nnet/batman-adv/multicast.c-1147-\tcase ETH_P_IPV6:\n--\nnet/batman-adv/multicast.c=1314=batadv_mcast_forw_tt(struct batadv_priv *bat_priv, struct sk_buff *skb,\n--\nnet/batman-adv/multicast.c-1346-/**\nnet/batman-adv/multicast.c:1347: * batadv_mcast_forw_want_all_ipv4() - forward to nodes with want-all-ipv4\nnet/batman-adv/multicast.c-1348- * @bat_priv: the bat priv with all the mesh interface information\n--\nnet/batman-adv/multicast.c=1359=static int\nnet/batman-adv/multicast.c:1360:batadv_mcast_forw_want_all_ipv4(struct batadv_priv *bat_priv,\nnet/batman-adv/multicast.c-1361-\t\t\t\tstruct sk_buff *skb, unsigned short vid)\n--\nnet/batman-adv/multicast.c-1368-\thlist_for_each_entry_rcu(orig_node,\nnet/batman-adv/multicast.c:1369:\t\t\t\t \u0026bat_priv-\u003emcast.want_all_ipv4_list,\nnet/batman-adv/multicast.c:1370:\t\t\t\t mcast_want_all_ipv4_node) {\nnet/batman-adv/multicast.c-1371-\t\tnewskb = skb_copy(skb, GFP_ATOMIC);\n--\nnet/batman-adv/multicast.c=1435=batadv_mcast_forw_want_all(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-1439-\tcase ETH_P_IP:\nnet/batman-adv/multicast.c:1440:\t\treturn batadv_mcast_forw_want_all_ipv4(bat_priv, skb, vid);\nnet/batman-adv/multicast.c-1441-\tcase ETH_P_IPV6:\n--\nnet/batman-adv/multicast.c=1612=static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-1646-/**\nnet/batman-adv/multicast.c:1647: * batadv_mcast_want_ipv4_update() - update want-all-ipv4 counter and list\nnet/batman-adv/multicast.c-1648- * @bat_priv: the bat priv with all the mesh interface information\n--\nnet/batman-adv/multicast.c-1656- */\nnet/batman-adv/multicast.c:1657:static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,\nnet/batman-adv/multicast.c-1658-\t\t\t\t\t  struct batadv_orig_node *orig,\n--\nnet/batman-adv/multicast.c-1660-{\nnet/batman-adv/multicast.c:1661:\tstruct hlist_head *head = \u0026bat_priv-\u003emcast.want_all_ipv4_list;\nnet/batman-adv/multicast.c:1662:\tstruct hlist_node *node = \u0026orig-\u003emcast_want_all_ipv4_node;\nnet/batman-adv/multicast.c-1663-\n--\nnet/batman-adv/multicast.c-1668-\t    !(orig-\u003emcast_flags \u0026 BATADV_MCAST_WANT_ALL_IPV4)) {\nnet/batman-adv/multicast.c:1669:\t\tatomic_inc(\u0026bat_priv-\u003emcast.num_want_all_ipv4);\nnet/batman-adv/multicast.c-1670-\n--\nnet/batman-adv/multicast.c-1679-\t\t   orig-\u003emcast_flags \u0026 BATADV_MCAST_WANT_ALL_IPV4) {\nnet/batman-adv/multicast.c:1680:\t\tatomic_dec(\u0026bat_priv-\u003emcast.num_want_all_ipv4);\nnet/batman-adv/multicast.c-1681-\n--\nnet/batman-adv/multicast.c=1890=static void batadv_mcast_tvlv_ogm_handler(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast.c-1914-\tbatadv_mcast_want_unsnoop_update(bat_priv, orig, mcast_flags);\nnet/batman-adv/multicast.c:1915:\tbatadv_mcast_want_ipv4_update(bat_priv, orig, mcast_flags);\nnet/batman-adv/multicast.c-1916-\tbatadv_mcast_want_ipv6_update(bat_priv, orig, mcast_flags);\n--\nnet/batman-adv/multicast.c=1950=int batadv_mcast_mesh_info_put(struct sk_buff *msg,\n--\nnet/batman-adv/multicast.c-1958-\nnet/batman-adv/multicast.c:1959:\t\tif (bat_priv-\u003emcast.mla_flags.querier_ipv4.exists)\nnet/batman-adv/multicast.c-1960-\t\t\tflags_priv |= BATADV_MCAST_FLAGS_QUERIER_IPV4_EXISTS;\n--\nnet/batman-adv/multicast.c-1962-\t\t\tflags_priv |= BATADV_MCAST_FLAGS_QUERIER_IPV6_EXISTS;\nnet/batman-adv/multicast.c:1963:\t\tif (bat_priv-\u003emcast.mla_flags.querier_ipv4.shadowing)\nnet/batman-adv/multicast.c-1964-\t\t\tflags_priv |= BATADV_MCAST_FLAGS_QUERIER_IPV4_SHADOWING;\n--\nnet/batman-adv/multicast.c=2189=void batadv_mcast_purge_orig(struct batadv_orig_node *orig)\n--\nnet/batman-adv/multicast.c-2195-\tbatadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);\nnet/batman-adv/multicast.c:2196:\tbatadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);\nnet/batman-adv/multicast.c-2197-\tbatadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);\n--\nnet/batman-adv/multicast_forw.c=114=batadv_mcast_forw_orig_entry(struct hlist_node *node,\n--\nnet/batman-adv/multicast_forw.c-118-\tswitch (entry_offset) {\nnet/batman-adv/multicast_forw.c:119:\tcase offsetof(struct batadv_orig_node, mcast_want_all_ipv4_node):\nnet/batman-adv/multicast_forw.c-120-\tcase offsetof(struct batadv_orig_node, mcast_want_all_ipv6_node):\n--\nnet/batman-adv/multicast_forw.c=273=static bool batadv_mcast_forw_push_want_all(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/multicast_forw.c-284-\tcase htons(ETH_P_IP):\nnet/batman-adv/multicast_forw.c:285:\t\thead = \u0026bat_priv-\u003emcast.want_all_ipv4_list;\nnet/batman-adv/multicast_forw.c-286-\t\toffset = offsetof(struct batadv_orig_node,\nnet/batman-adv/multicast_forw.c:287:\t\t\t\t  mcast_want_all_ipv4_node);\nnet/batman-adv/multicast_forw.c-288-\t\tbreak;\n--\nnet/batman-adv/originator.c=947=struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,\n--\nnet/batman-adv/originator.c-988-\tINIT_HLIST_NODE(\u0026orig_node-\u003emcast_want_all_unsnoopables_node);\nnet/batman-adv/originator.c:989:\tINIT_HLIST_NODE(\u0026orig_node-\u003emcast_want_all_ipv4_node);\nnet/batman-adv/originator.c-990-\tINIT_HLIST_NODE(\u0026orig_node-\u003emcast_want_all_ipv6_node);\n--\nnet/batman-adv/types.h=411=struct batadv_orig_node {\n--\nnet/batman-adv/types.h-451-\t/**\nnet/batman-adv/types.h:452:\t * @mcast_want_all_ipv4_node: a list node for the mcast.want_all_ipv4\nnet/batman-adv/types.h-453-\t *  list\nnet/batman-adv/types.h-454-\t */\nnet/batman-adv/types.h:455:\tstruct hlist_node mcast_want_all_ipv4_node;\nnet/batman-adv/types.h-456-\t/**\n--\nnet/batman-adv/types.h=1221=struct batadv_mcast_mla_flags {\nnet/batman-adv/types.h:1222:\t/** @querier_ipv4: the current state of an IGMP querier in the mesh */\nnet/batman-adv/types.h:1223:\tstruct batadv_mcast_querier_state querier_ipv4;\nnet/batman-adv/types.h-1224-\n--\nnet/batman-adv/types.h=1241=struct batadv_priv_mcast {\n--\nnet/batman-adv/types.h-1254-\t/**\nnet/batman-adv/types.h:1255:\t * @want_all_ipv4_list: a list of orig_nodes wanting all IPv4 multicast\nnet/batman-adv/types.h-1256-\t *  traffic\nnet/batman-adv/types.h-1257-\t */\nnet/batman-adv/types.h:1258:\tstruct hlist_head want_all_ipv4_list;\nnet/batman-adv/types.h-1259-\n--\nnet/batman-adv/types.h-1293-\nnet/batman-adv/types.h:1294:\t/** @num_want_all_ipv4: counter for items in want_all_ipv4_list */\nnet/batman-adv/types.h:1295:\tatomic_t num_want_all_ipv4;\nnet/batman-adv/types.h-1296-\n--\nnet/batman-adv/types.h-1313-\t * @want_lists_lock: lock for protecting modifications to mcasts\nnet/batman-adv/types.h:1314:\t *  want_all_{unsnoopables,ipv4,ipv6}_list (traversals are rcu-locked)\nnet/batman-adv/types.h-1315-\t */\n--\nnet/bridge/br_arp_nd_proxy.c=125=void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,\n--\nnet/bridge/br_arp_nd_proxy.c-156-\nnet/bridge/br_arp_nd_proxy.c:157:\tif (ipv4_is_loopback(tip) ||\nnet/bridge/br_arp_nd_proxy.c:158:\t    ipv4_is_multicast(tip))\nnet/bridge/br_arp_nd_proxy.c-159-\t\treturn;\n--\nnet/bridge/br_mdb.c=669=static bool is_valid_mdb_source(struct nlattr *attr, __be16 proto,\n--\nnet/bridge/br_mdb.c-677-\t\t}\nnet/bridge/br_mdb.c:678:\t\tif (ipv4_is_multicast(nla_get_in_addr(attr))) {\nnet/bridge/br_mdb.c-679-\t\t\tNL_SET_ERR_MSG_MOD(extack, \"IPv4 multicast source address is not allowed\");\n--\nnet/bridge/br_mdb.c=1231=static int br_mdb_config_init(struct br_mdb_config *cfg, struct net_device *dev,\n--\nnet/bridge/br_mdb.c-1277-\tif (cfg-\u003eentry-\u003eaddr.proto == htons(ETH_P_IP) \u0026\u0026\nnet/bridge/br_mdb.c:1278:\t    ipv4_is_zeronet(cfg-\u003eentry-\u003eaddr.u.ip4)) {\nnet/bridge/br_mdb.c-1279-\t\tNL_SET_ERR_MSG_MOD(extack, \"IPv4 entry group address 0.0.0.0 is not allowed\");\n--\nnet/bridge/br_multicast.c=1355=br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)\n--\nnet/bridge/br_multicast.c-1363-\tcase htons(ETH_P_IP):\nnet/bridge/br_multicast.c:1364:\t\tif (ipv4_is_zeronet(src_ip-\u003esrc.ip4) ||\nnet/bridge/br_multicast.c:1365:\t\t    ipv4_is_multicast(src_ip-\u003esrc.ip4))\nnet/bridge/br_multicast.c-1366-\t\t\treturn NULL;\n--\nnet/bridge/br_multicast.c=1569=static int br_ip4_multicast_add_group(struct net_bridge_mcast *brmctx,\n--\nnet/bridge/br_multicast.c-1578-\nnet/bridge/br_multicast.c:1579:\tif (ipv4_is_local_multicast(group))\nnet/bridge/br_multicast.c-1580-\t\treturn 0;\n--\nnet/bridge/br_multicast.c=3818=static void br_ip4_multicast_leave_group(struct net_bridge_mcast *brmctx,\n--\nnet/bridge/br_multicast.c-3826-\nnet/bridge/br_multicast.c:3827:\tif (ipv4_is_local_multicast(group))\nnet/bridge/br_multicast.c-3828-\t\treturn;\n--\nnet/bridge/br_multicast.c=3918=static int br_ip4_multicast_mrd_rcv(struct net_bridge_mcast *brmctx,\n--\nnet/bridge/br_multicast.c-3932-\nnet/bridge/br_multicast.c:3933:static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,\nnet/bridge/br_multicast.c-3934-\t\t\t\t struct net_bridge_mcast_port *pmctx,\n--\nnet/bridge/br_multicast.c-3945-\tif (err == -ENOMSG) {\nnet/bridge/br_multicast.c:3946:\t\tif (!ipv4_is_local_multicast(ip_hdr(skb)-\u003edaddr)) {\nnet/bridge/br_multicast.c-3947-\t\t\tBR_INPUT_SKB_CB(skb)-\u003emrouters_only = 1;\nnet/bridge/br_multicast.c:3948:\t\t} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)-\u003edaddr)) {\nnet/bridge/br_multicast.c-3949-\t\t\tif (ip_hdr(skb)-\u003eprotocol == IPPROTO_PIM)\nnet/bridge/br_multicast.c-3950-\t\t\t\tbr_multicast_pim(brmctx, pmctx, skb);\nnet/bridge/br_multicast.c:3951:\t\t} else if (ipv4_is_all_snoopers(ip_hdr(skb)-\u003edaddr)) {\nnet/bridge/br_multicast.c-3952-\t\t\tbr_ip4_multicast_mrd_rcv(brmctx, pmctx, skb);\n--\nnet/bridge/br_multicast.c=4057=int br_multicast_rcv(struct net_bridge_mcast **brmctx,\n--\nnet/bridge/br_multicast.c-4091-\tcase htons(ETH_P_IP):\nnet/bridge/br_multicast.c:4092:\t\tret = br_multicast_ipv4_rcv(*brmctx, *pmctx, skb, vid);\nnet/bridge/br_multicast.c-4093-\t\tbreak;\n--\nnet/bridge/br_multicast.c=4730=int br_multicast_toggle(struct net_bridge *br, unsigned long val,\n--\nnet/bridge/br_multicast.c-4772-\t * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and\nnet/bridge/br_multicast.c:4773:\t * returns without calling br_multicast_ipv4/6_rcv if it's not\nnet/bridge/br_multicast.c-4774-\t * enabled. Moved both functions out just for symmetry.\n--\nnet/bridge/br_netfilter_hooks.c-25-#include \u003cuapi/linux/netfilter_bridge.h\u003e\nnet/bridge/br_netfilter_hooks.c:26:#include \u003clinux/netfilter_ipv4.h\u003e\nnet/bridge/br_netfilter_hooks.c-27-#include \u003clinux/netfilter_ipv6.h\u003e\n--\nnet/bridge/br_netfilter_hooks.c=193=static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)\n--\nnet/bridge/br_netfilter_hooks.c-205-\nnet/bridge/br_netfilter_hooks.c:206:static int br_validate_ipv4(struct net *net, struct sk_buff *skb)\nnet/bridge/br_netfilter_hooks.c-207-{\n--\nnet/bridge/br_netfilter_hooks.c=330=static inline bool\nnet/bridge/br_netfilter_hooks.c:331:br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,\nnet/bridge/br_netfilter_hooks.c-332-\t\t\t     const struct nf_bridge_info *nf_bridge)\nnet/bridge/br_netfilter_hooks.c-333-{\nnet/bridge/br_netfilter_hooks.c:334:\treturn ip_hdr(skb)-\u003edaddr != nf_bridge-\u003eipv4_daddr;\nnet/bridge/br_netfilter_hooks.c-335-}\n--\nnet/bridge/br_netfilter_hooks.c=376=static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)\n--\nnet/bridge/br_netfilter_hooks.c-396-\tnf_bridge-\u003ein_prerouting = 0;\nnet/bridge/br_netfilter_hooks.c:397:\tif (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {\nnet/bridge/br_netfilter_hooks.c-398-\t\treason = ip_route_input(skb, iph-\u003edaddr, iph-\u003esaddr,\n--\nnet/bridge/br_netfilter_hooks.c=483=static unsigned int br_nf_pre_routing(void *priv,\n--\nnet/bridge/br_netfilter_hooks.c-524-\nnet/bridge/br_netfilter_hooks.c:525:\tif (br_validate_ipv4(state-\u003enet, skb))\nnet/bridge/br_netfilter_hooks.c-526-\t\treturn NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);\n--\nnet/bridge/br_netfilter_hooks.c-533-\tnf_bridge = nf_bridge_info_get(skb);\nnet/bridge/br_netfilter_hooks.c:534:\tnf_bridge-\u003eipv4_daddr = ip_hdr(skb)-\u003edaddr;\nnet/bridge/br_netfilter_hooks.c-535-\n--\nnet/bridge/br_netfilter_hooks.c=673=static unsigned int br_nf_forward_ip(struct sk_buff *skb,\n--\nnet/bridge/br_netfilter_hooks.c-704-\tif (pf == NFPROTO_IPV4) {\nnet/bridge/br_netfilter_hooks.c:705:\t\tif (br_validate_ipv4(state-\u003enet, skb))\nnet/bridge/br_netfilter_hooks.c-706-\t\t\treturn NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);\n--\nnet/bridge/br_netfilter_hooks.c=835=static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)\n--\nnet/bridge/br_netfilter_hooks.c-870-\nnet/bridge/br_netfilter_hooks.c:871:\t\tif (br_validate_ipv4(net, skb))\nnet/bridge/br_netfilter_hooks.c-872-\t\t\tgoto drop;\n--\nnet/bridge/br_netfilter_ipv6.c-24-#include \u003clinux/netfilter_bridge.h\u003e\nnet/bridge/br_netfilter_ipv6.c:25:#include \u003clinux/netfilter_ipv4.h\u003e\nnet/bridge/br_netfilter_ipv6.c-26-#include \u003clinux/netfilter_ipv6.h\u003e\n--\nnet/bridge/br_private.h=1204=static inline bool br_multicast_is_star_g(const struct br_ip *ip)\n--\nnet/bridge/br_private.h-1207-\tcase htons(ETH_P_IP):\nnet/bridge/br_private.h:1208:\t\treturn ipv4_is_zeronet(ip-\u003esrc.ip4);\nnet/bridge/br_private.h-1209-#if IS_ENABLED(CONFIG_IPV6)\n--\nnet/bridge/netfilter/nf_conntrack_bridge.c-18-\nnet/bridge/netfilter/nf_conntrack_bridge.c:19:#include \u003clinux/netfilter_ipv4.h\u003e\nnet/bridge/netfilter/nf_conntrack_bridge.c-20-\n--\nnet/bridge/netfilter/nft_reject_bridge.c-13-#include \u003cnet/netfilter/nft_reject.h\u003e\nnet/bridge/netfilter/nft_reject_bridge.c:14:#include \u003cnet/netfilter/ipv4/nf_reject.h\u003e\nnet/bridge/netfilter/nft_reject_bridge.c-15-#include \u003cnet/netfilter/ipv6/nf_reject.h\u003e\n--\nnet/ceph/messenger.c=364=static void ceph_sock_write_space(struct sock *sk)\n--\nnet/ceph/messenger.c-371-\t * doesn't get called again until ceph_con_v[12]_try_write() fills\nnet/ceph/messenger.c:372:\t * the socket buffer. See net/ipv4/tcp_input.c:tcp_check_space()\nnet/ceph/messenger.c-373-\t * and net/core/stream.c:sk_stream_write_space().\n--\nnet/core/dev.c=3363=void netif_set_tso_max_size(struct net_device *dev, unsigned int size)\n--\nnet/core/dev.c-3367-\t\tnetif_set_gso_max_size(dev, size);\nnet/core/dev.c:3368:\tif (size \u003c READ_ONCE(dev-\u003egso_ipv4_max_size))\nnet/core/dev.c:3369:\t\tnetif_set_gso_ipv4_max_size(dev, size);\nnet/core/dev.c-3370-}\n--\nnet/core/dev.c=12094=struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,\n--\nnet/core/dev.c-12145-\tdev-\u003egro_max_size = GRO_LEGACY_MAX_SIZE;\nnet/core/dev.c:12146:\tdev-\u003egso_ipv4_max_size = GSO_LEGACY_MAX_SIZE;\nnet/core/dev.c:12147:\tdev-\u003egro_ipv4_max_size = GRO_LEGACY_MAX_SIZE;\nnet/core/dev.c-12148-\tdev-\u003etso_max_size = TSO_LEGACY_MAX_SIZE;\n--\nnet/core/dev.c=13298=static void __init net_dev_struct_check(void)\n--\nnet/core/dev.c-13306-\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_tx, gso_max_size);\nnet/core/dev.c:13307:\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_tx, gso_ipv4_max_size);\nnet/core/dev.c-13308-\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_tx, gso_max_segs);\n--\nnet/core/dev.c-13339-\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_rx, gro_max_size);\nnet/core/dev.c:13340:\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_rx, gro_ipv4_max_size);\nnet/core/dev.c-13341-\tCACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_rx, rx_handler);\n--\nnet/core/dev.h=205=static inline void netif_set_gso_max_size(struct net_device *dev,\n--\nnet/core/dev.h-210-\tif (size \u003c= GSO_LEGACY_MAX_SIZE)\nnet/core/dev.h:211:\t\tWRITE_ONCE(dev-\u003egso_ipv4_max_size, size);\nnet/core/dev.h-212-}\n--\nnet/core/dev.h=221=static inline void netif_set_gro_max_size(struct net_device *dev,\n--\nnet/core/dev.h-226-\tif (size \u003c= GRO_LEGACY_MAX_SIZE)\nnet/core/dev.h:227:\t\tWRITE_ONCE(dev-\u003egro_ipv4_max_size, size);\nnet/core/dev.h-228-}\nnet/core/dev.h-229-\nnet/core/dev.h:230:static inline void netif_set_gso_ipv4_max_size(struct net_device *dev,\nnet/core/dev.h-231-\t\t\t\t\t       unsigned int size)\nnet/core/dev.h-232-{\nnet/core/dev.h:233:\t/* dev-\u003egso_ipv4_max_size is read locklessly from sk_setup_caps() */\nnet/core/dev.h:234:\tWRITE_ONCE(dev-\u003egso_ipv4_max_size, size);\nnet/core/dev.h-235-}\n\n"
}

gemini-3.7-flash

null

null

							input: 20152
							output: 122
							thoughts: 498
						

**Analysis of `ip_cmsg_recv_offset` for Fuzzing Candidate**

Okay, let's break this down. First, I needed to confirm the dependencies for `ip_cmsg_recv_offset`. I started by checking the `net/Kconfig` and confirmed that `CONFIG_INET` is the primary factor. Specifically, line 114 defines it. Then, I needed to see if `CONFIG_IPV6` was also relevant, since IPv6 often interacts with IPv4 code. A check of `net/ipv6/Kconfig` confirmed `CONFIG_IPV6` compiles `net/ipv6/`, and `CONFIG_INET` compiles `net/ipv4/`.

I then traced the function and found that `ip_cmsg_recv_offset` is defined in `net/ipv4/ip_sockglue.c`, which gets compiled under `CONFIG_INET=y`. But here's the kicker: I see `CONFIG_IPV6` might be involved because `udpv6_recvmsg` and `ipv6_recv_error` *also* call `ip_cmsg_recv_offset` and `ip_cmsg_recv` if `inet_cmsg_flags(inet)` is non-zero (which happens with IPv4-mapped IPv6 sockets or IPv6 sockets with IPv4 cmsg enabled). This tells me it's important to test with IPv6 enabled as well.

Next, I looked at the function definition of `ip_cmsg_recv_offset`. I confirmed that the function is not static and is exported. The definition is:
```c
void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,
			 struct sk_buff *skb, int tlen, int offset)
```
with an `EXPORT_SYMBOL(ip_cmsg_recv_offset)`.

I then made sure the requirements were all in place: `WorthFuzzing` is true, the `FocusSymbols` are ["ip_cmsg_recv_offset"], and `EnableConfigs` are ["INET", "IPV6"].

Finally, I noticed there's a version check `if (unlikely(ip_hdr(skb)->version != IPVERSION)) return;` in `ip_cmsg_recv_offset`. This is a *critical* piece of information. That's a strong indicator that this is a good candidate, as it protects against potential out-of-bounds reads or invalid header access when control messages (cmsg) are processed for non-IPv4 packets (like IPv6 packets on dual-stack or mapped sockets, or corrupted sockets). It seems like it prevents corrupted packets or invalid IP version in control messages. This suggests it's a good place to test fuzzing inputs.

This all looks very clean and well-defined. I'm satisfied. Time to call `set-results`.

{
  "EnableConfigs": [
    "INET",
    "IPV6"
  ],
  "FocusSymbols": [
    "ip_cmsg_recv_offset"
  ],
  "Reasoning": "The patch adds a validation check in ip_cmsg_recv_offset() to verify that the IP header version matches IPVERSION (IPv4) before parsing IPv4 control messages (cmsg) from the skb. This affects socket recvmsg processing across IPv4 and dual-stack IPv6 sockets and prevents malformed or cross-protocol header misinterpretation.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "INET",
    "IPV6"
  ],
  "FocusSymbols": [
    "ip_cmsg_recv_offset"
  ],
  "Reasoning": "The patch adds a validation check in ip_cmsg_recv_offset() to verify that the IP header version matches IPVERSION (IPv4) before parsing IPv4 control messages (cmsg) from the skb. This affects socket recvmsg processing across IPv4 and dual-stack IPv6 sockets and prevents malformed or cross-protocol header misinterpretation.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch adds a check `ip_hdr(skb)-\u003eversion != IPVERSION` at the entry of `ip_cmsg_recv_offset()` to return early if the packet is not an IPv4 packet (e.g. when processing dual-stack or IPv6 skbs).\n\nThis change only adds an early return validation check on the packet header version. It does not introduce any new stack/heap allocations, does not modify data lengths or structure initialization, and does not expose or read uninitialized memory. Standard testing with KASAN is sufficient, and a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 94a5eec156fdfcd60ececec7485d73cceb4e45f5
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Aug 29 15:44:37 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index a55ef327ec932..01d264e8f34ea 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -174,6 +174,9 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,
 	if (!flags)
 		return;
 
+	if (unlikely(ip_hdr(skb)->version != IPVERSION))
+		return;
+
 	/* Ordered by supposed usage frequency */
 	if (flags & IP_CMSG_PKTINFO) {
 		ip_cmsg_recv_pktinfo(msg, skb);

gemini-3.7-flash

null

null

							input: 2079
							output: 39
							thoughts: 55
						

**Examining the IP Socket Glue**

Okay, let's dive in. I need to get a clear picture of this diff and its context, so I'm heading straight for `net/ipv4/ip_sockglue.c`. My initial plan is to use a `read-file` command to pinpoint a specific area; specifically, I'll be targeting the vicinity of line 174 within the `ip_sockglue.c` file. Hopefully, this will provide the details required.

{
  "File": "net/ipv4/ip_sockglue.c",
  "FirstLine": 160,
  "LineCount": 80
}

{
  "Contents": " 160:\t\n 161:\t\tsin.sin_family = AF_INET;\n 162:\t\tsin.sin_addr.s_addr = ip_hdr(skb)-\u003edaddr;\n 163:\t\tsin.sin_port = ports[1];\n 164:\t\tmemset(sin.sin_zero, 0, sizeof(sin.sin_zero));\n 165:\t\n 166:\t\tput_cmsg(msg, SOL_IP, IP_ORIGDSTADDR, sizeof(sin), \u0026sin);\n 167:\t}\n 168:\t\n 169:\tvoid ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\n 170:\t\t\t\t struct sk_buff *skb, int tlen, int offset)\n 171:\t{\n 172:\t\tunsigned long flags = inet_cmsg_flags(inet_sk(sk));\n 173:\t\n 174:\t\tif (!flags)\n 175:\t\t\treturn;\n 176:\t\n 177:\t\tif (unlikely(ip_hdr(skb)-\u003eversion != IPVERSION))\n 178:\t\t\treturn;\n 179:\t\n 180:\t\t/* Ordered by supposed usage frequency */\n 181:\t\tif (flags \u0026 IP_CMSG_PKTINFO) {\n 182:\t\t\tip_cmsg_recv_pktinfo(msg, skb);\n 183:\t\n 184:\t\t\tflags \u0026= ~IP_CMSG_PKTINFO;\n 185:\t\t\tif (!flags)\n 186:\t\t\t\treturn;\n 187:\t\t}\n 188:\t\n 189:\t\tif (flags \u0026 IP_CMSG_TTL) {\n 190:\t\t\tip_cmsg_recv_ttl(msg, skb);\n 191:\t\n 192:\t\t\tflags \u0026= ~IP_CMSG_TTL;\n 193:\t\t\tif (!flags)\n 194:\t\t\t\treturn;\n 195:\t\t}\n 196:\t\n 197:\t\tif (flags \u0026 IP_CMSG_TOS) {\n 198:\t\t\tip_cmsg_recv_tos(msg, skb);\n 199:\t\n 200:\t\t\tflags \u0026= ~IP_CMSG_TOS;\n 201:\t\t\tif (!flags)\n 202:\t\t\t\treturn;\n 203:\t\t}\n 204:\t\n 205:\t\tif (flags \u0026 IP_CMSG_RECVOPTS) {\n 206:\t\t\tip_cmsg_recv_opts(msg, skb);\n 207:\t\n 208:\t\t\tflags \u0026= ~IP_CMSG_RECVOPTS;\n 209:\t\t\tif (!flags)\n 210:\t\t\t\treturn;\n 211:\t\t}\n 212:\t\n 213:\t\tif (flags \u0026 IP_CMSG_RETOPTS) {\n 214:\t\t\tip_cmsg_recv_retopts(sock_net(sk), msg, skb);\n 215:\t\n 216:\t\t\tflags \u0026= ~IP_CMSG_RETOPTS;\n 217:\t\t\tif (!flags)\n 218:\t\t\t\treturn;\n 219:\t\t}\n 220:\t\n 221:\t\tif (flags \u0026 IP_CMSG_PASSSEC) {\n 222:\t\t\tip_cmsg_recv_security(msg, skb);\n 223:\t\n 224:\t\t\tflags \u0026= ~IP_CMSG_PASSSEC;\n 225:\t\t\tif (!flags)\n 226:\t\t\t\treturn;\n 227:\t\t}\n 228:\t\n 229:\t\tif (flags \u0026 IP_CMSG_ORIGDSTADDR) {\n 230:\t\t\tip_cmsg_recv_dstaddr(msg, skb);\n 231:\t\n 232:\t\t\tflags \u0026= ~IP_CMSG_ORIGDSTADDR;\n 233:\t\t\tif (!flags)\n 234:\t\t\t\treturn;\n 235:\t\t}\n 236:\t\n 237:\t\tif (flags \u0026 IP_CMSG_CHECKSUM)\n 238:\t\t\tip_cmsg_recv_checksum(msg, skb, tlen, offset);\n 239:\t\n"
}

gemini-3.7-flash

null

null

							input: 3388
							output: 22
							thoughts: 99
						

**Analyzing a Network Patch**

Okay, let's dive into this patch and understand its implications. First, I'm examining this `ip_cmsg_recv_offset` change. I see a new conditional check has been added: `if (unlikely(ip_hdr(skb)->version != IPVERSION)) return;`. My immediate thought is, "Why is *this* check necessary? What's the rationale?" I need to understand the context and the potential vulnerabilities being addressed.

To get a clearer picture, I'll need to reconstruct its evolution. I'll start by searching the Git history associated with this function. Who introduced it? What issues were flagged, and what was the justification? If the commit history doesn't provide enough context, I'll broaden the search. I'll do a codebase-wide grep for `ip_cmsg_recv_offset`. This will show me all the call sites, allowing me to see how and where this function is used and, more importantly, *why* this new check is relevant to those uses. The surrounding code is often the most illuminating. I expect the callers to provide the necessary clues to understand the purpose of this guard.

{
  "Expression": "ip_cmsg_recv_offset"
}

{
  "Output": "include/net/ip.h=815=void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb, bool drop_dst);\ninclude/net/ip.h:816:void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\ninclude/net/ip.h-817-\t\t\t struct sk_buff *skb, int tlen, int offset);\n--\ninclude/net/ip.h=838=static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)\ninclude/net/ip.h-839-{\ninclude/net/ip.h:840:\tip_cmsg_recv_offset(msg, skb-\u003esk, skb, 0, 0);\ninclude/net/ip.h-841-}\n--\nnet/ipv4/ip_sockglue.c=147=static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)\n--\nnet/ipv4/ip_sockglue.c-168-\nnet/ipv4/ip_sockglue.c:169:void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,\nnet/ipv4/ip_sockglue.c-170-\t\t\t struct sk_buff *skb, int tlen, int offset)\n--\nnet/ipv4/ip_sockglue.c-242-}\nnet/ipv4/ip_sockglue.c:243:EXPORT_SYMBOL(ip_cmsg_recv_offset);\nnet/ipv4/ip_sockglue.c-244-\n--\nnet/ipv4/udp.c=2033=int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags)\n--\nnet/ipv4/udp.c-2111-\tif (inet_cmsg_flags(inet))\nnet/ipv4/udp.c:2112:\t\tip_cmsg_recv_offset(msg, sk, skb, sizeof(struct udphdr), off);\nnet/ipv4/udp.c-2113-\n--\nnet/ipv6/udp.c=464=int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,\n--\nnet/ipv6/udp.c-561-\t\tif (inet_cmsg_flags(inet))\nnet/ipv6/udp.c:562:\t\t\tip_cmsg_recv_offset(msg, sk, skb,\nnet/ipv6/udp.c-563-\t\t\t\t\t    sizeof(struct udphdr), off);\n"
}

gemini-3.7-flash

null

null

							input: 4436
							output: 39
							thoughts: 265
						

**My Analysis of a Potential UDP Vulnerability**

Okay, so I'm digging into `net/ipv6/udp.c`, specifically looking at how dual-stack or IPv6 sockets handle incoming IPv4 or IPv6 packets. My initial concern is this: if I'm receiving a packet and `inet_cmsg_flags(inet)` is set – which, in this context, implies IPv4 control message options were used on an AF_INET6 or dual-stack socket – the code calls `ip_cmsg_recv_offset()`. The issue is, this function gets called on an IPv6 skb, so `ip_hdr(skb)` is *actually* pointing to an IPv6 header.

Here's the rub: `ip_cmsg_recv_offset()` subsequently calls a bunch of other functions like `ip_cmsg_recv_opts`, `ip_cmsg_recv_pktinfo`, and so on. These functions, critically, all seem to treat `ip_hdr(skb)` as a `struct iphdr` – that is, an IPv4 header! Now, if the incoming packet is actually IPv6 (and `version == 6`), we're effectively misinterpreting the memory. This could lead to all sorts of nasty things. We're potentially reading past the end of the header, accessing invalid fields, or just generally making incorrect decisions based on malformed data.

I need to investigate what those `ip_cmsg_recv_*` functions are doing in detail, because I suspect this is a textbook example of a type confusion vulnerability and the ramifications could be serious. I need to figure out just how much control an attacker could potentially gain.

{
  "File": "net/ipv4/ip_sockglue.c",
  "FirstLine": 50,
  "LineCount": 100
}

{
  "Contents": "  50:\t/*\n  51:\t *\tSOL_IP control messages.\n  52:\t */\n  53:\t\n  54:\tstatic void ip_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)\n  55:\t{\n  56:\t\tstruct in_pktinfo info = *PKTINFO_SKB_CB(skb);\n  57:\t\n  58:\t\tinfo.ipi_addr.s_addr = ip_hdr(skb)-\u003edaddr;\n  59:\t\n  60:\t\tput_cmsg(msg, SOL_IP, IP_PKTINFO, sizeof(info), \u0026info);\n  61:\t}\n  62:\t\n  63:\tstatic void ip_cmsg_recv_ttl(struct msghdr *msg, struct sk_buff *skb)\n  64:\t{\n  65:\t\tint ttl = ip_hdr(skb)-\u003ettl;\n  66:\t\tput_cmsg(msg, SOL_IP, IP_TTL, sizeof(int), \u0026ttl);\n  67:\t}\n  68:\t\n  69:\tstatic void ip_cmsg_recv_tos(struct msghdr *msg, struct sk_buff *skb)\n  70:\t{\n  71:\t\tput_cmsg(msg, SOL_IP, IP_TOS, 1, \u0026ip_hdr(skb)-\u003etos);\n  72:\t}\n  73:\t\n  74:\tstatic void ip_cmsg_recv_opts(struct msghdr *msg, struct sk_buff *skb)\n  75:\t{\n  76:\t\tif (IPCB(skb)-\u003eopt.optlen == 0)\n  77:\t\t\treturn;\n  78:\t\n  79:\t\tput_cmsg(msg, SOL_IP, IP_RECVOPTS, IPCB(skb)-\u003eopt.optlen,\n  80:\t\t\t ip_hdr(skb) + 1);\n  81:\t}\n  82:\t\n  83:\t\n  84:\tstatic void ip_cmsg_recv_retopts(struct net *net, struct msghdr *msg,\n  85:\t\t\t\t\t struct sk_buff *skb)\n  86:\t{\n  87:\t\tunsigned char optbuf[sizeof(struct ip_options) + 40];\n  88:\t\tstruct ip_options *opt = (struct ip_options *)optbuf;\n  89:\t\n  90:\t\tif (IPCB(skb)-\u003eopt.optlen == 0)\n  91:\t\t\treturn;\n  92:\t\n  93:\t\tif (ip_options_echo(net, opt, skb)) {\n  94:\t\t\tmsg-\u003emsg_flags |= MSG_CTRUNC;\n  95:\t\t\treturn;\n  96:\t\t}\n  97:\t\tip_options_undo(opt);\n  98:\t\n  99:\t\tput_cmsg(msg, SOL_IP, IP_RETOPTS, opt-\u003eoptlen, opt-\u003e__data);\n 100:\t}\n 101:\t\n 102:\tstatic void ip_cmsg_recv_fragsize(struct msghdr *msg, struct sk_buff *skb)\n 103:\t{\n 104:\t\tint val;\n 105:\t\n 106:\t\tif (IPCB(skb)-\u003efrag_max_size == 0)\n 107:\t\t\treturn;\n 108:\t\n 109:\t\tval = IPCB(skb)-\u003efrag_max_size;\n 110:\t\tput_cmsg(msg, SOL_IP, IP_RECVFRAGSIZE, sizeof(val), \u0026val);\n 111:\t}\n 112:\t\n 113:\tstatic void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,\n 114:\t\t\t\t\t  int tlen, int offset)\n 115:\t{\n 116:\t\t__wsum csum = skb-\u003ecsum;\n 117:\t\n 118:\t\tif (skb-\u003eip_summed != CHECKSUM_COMPLETE)\n 119:\t\t\treturn;\n 120:\t\n 121:\t\tif (offset != 0) {\n 122:\t\t\tint tend_off = skb_transport_offset(skb) + tlen;\n 123:\t\t\tcsum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0));\n 124:\t\t}\n 125:\t\n 126:\t\tput_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), \u0026csum);\n 127:\t}\n 128:\t\n 129:\tstatic void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)\n 130:\t{\n 131:\t\tstruct lsm_context ctx;\n 132:\t\tu32 secid;\n 133:\t\tint err;\n 134:\t\n 135:\t\terr = security_socket_getpeersec_dgram(NULL, skb, \u0026secid);\n 136:\t\tif (err)\n 137:\t\t\treturn;\n 138:\t\n 139:\t\terr = security_secid_to_secctx(secid, \u0026ctx);\n 140:\t\tif (err \u003c 0)\n 141:\t\t\treturn;\n 142:\t\n 143:\t\tput_cmsg(msg, SOL_IP, SCM_SECURITY, ctx.len, ctx.context);\n 144:\t\tsecurity_release_secctx(\u0026ctx);\n 145:\t}\n 146:\t\n 147:\tstatic void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)\n 148:\t{\n 149:\t\t__be16 _ports[2], *ports;\n"
}

gemini-3.7-flash

null

null

							input: 6629
							output: 153
							thoughts: 496
						

**Analyzing the IP Header Sanity Check**

Okay, let's break this down. This patch introduces a quick sanity check at the start of `ip_cmsg_recv_offset`. The key thing is: `if (unlikely(ip_hdr(skb)->version != IPVERSION)) return;`. The question is, does this introduce *any* uninitialized memory problems? Let's go through it systematically.

First, does it create any *new* uninitialized memory or introduce a new uninitialized variable? Nope. `ip_hdr(skb)` accesses the IP header within the socket buffer, and `version` is a field within that IP header structure. If the IP version isn't 4 (which `IPVERSION` is defined as), it just returns – no cmsgs are touched.

Second, does it *expose* existing uninitialized memory? No again. This check *prevents* processing of non-IPv4 packets in the IPv4 cmsg receiver. That's a *good* thing.

Third, does it mess with control flow, bounds checking, or data length in a way that could lead to uninitialized memory being exposed or leaked? Nope. It just skips processing, which means it skips potential problems.

Fourth, are there any structure fields or memory that are copied to userspace and could be uninitialized? No new cmsgs are being created or copied. In fact, it skips calling `put_cmsg` for packets that fail the check.

So, this looks pretty safe. Let's make sure it's not a KASAN/KMSAN type issue: This check prevents misinterpretation of packet headers when `ip_cmsg_recv_offset` is called on non-IPv4 packets. This is pure logic validation and does not introduce uninitialized memory. Therefore, `NeedsKMSAN` should be `false`.

Let me quickly re-examine the original four criteria:

1.  **Kernel structures to userspace**: No new structures or modifications.
2.  **Conditional logic and uninitialized variables**: The condition checks the IP version field, which comes from the received packet.
3.  **Complex data structures**: No new allocation or initialization.
4.  **Bounds checks/logic**: No changes that would allow access to uninitialized bytes.

Alright, that's clear and unambiguous. I'm satisfied.

{
  "KMSANReasoning": "The patch adds a check `ip_hdr(skb)-\u003eversion != IPVERSION` at the entry of `ip_cmsg_recv_offset()` to return early if the packet is not an IPv4 packet (e.g. when processing dual-stack or IPv6 skbs).\n\nThis change only adds an early return validation check on the packet header version. It does not introduce any new stack/heap allocations, does not modify data lengths or structure initialization, and does not expose or read uninitialized memory. Standard testing with KASAN is sufficient, and a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch adds a check `ip_hdr(skb)-\u003eversion != IPVERSION` at the entry of `ip_cmsg_recv_offset()` to return early if the packet is not an IPv4 packet (e.g. when processing dual-stack or IPv6 skbs).\n\nThis change only adds an early return validation check on the packet header version. It does not introduce any new stack/heap allocations, does not modify data lengths or structure initialization, and does not expose or read uninitialized memory. Standard testing with KASAN is sufficient, and a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}