AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the NXP/Freescale ENETC ethernet controller driver (drivers/net/ethernet/freescale/enetc/), adjusting TX frame padding, TSO handling, and XDP locking. ENETC is an integrated controller found on NXP SoCs (e.g., LS1028A, i.MX95) and requires physical hardware not emulated in standard QEMU/GCE virtualized test environments on amd64. Therefore, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 53aef6fcdf2e638127935357ffa45ef65c2d8d01\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Oct 15 13:47:53 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c\nindex 80f0082f6c633..3003a415418ba 100644\n--- a/drivers/net/ethernet/freescale/enetc/enetc.c\n+++ b/drivers/net/ethernet/freescale/enetc/enetc.c\n@@ -168,6 +168,14 @@ static void enetc_free_tx_frame(struct enetc_bdr *tx_ring,\n \n \tif (tx_swbd-\u003edma)\n \t\tenetc_unmap_tx_buff(tx_ring, tx_swbd);\n+\tif (tx_swbd-\u003eis_xdp_tx) {\n+\t\tstruct enetc_ndev_priv *priv = netdev_priv(tx_ring-\u003endev);\n+\t\tstruct enetc_bdr *rx_ring;\n+\n+\t\trx_ring = enetc_rx_ring_from_xdp_tx_ring(priv, tx_ring);\n+\t\trx_ring-\u003exdp.xdp_tx_in_flight--;\n+\t\t__free_page(tx_swbd-\u003epage);\n+\t}\n \n \tif (xdp_frame) {\n \t\txdp_return_frame(tx_swbd-\u003exdp_frame);\n@@ -527,7 +535,7 @@ static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb)\n static int enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb,\n \t\t\t\tstruct enetc_tx_swbd *tx_swbd,\n \t\t\t\tunion enetc_tx_bd *txbd, int *i, int hdr_len,\n-\t\t\t\tint data_len)\n+\t\t\t\tint data_len, int frm_len)\n {\n \tunion enetc_tx_bd txbd_tmp;\n \tu8 flags = 0, e_flags = 0;\n@@ -544,7 +552,7 @@ static int enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb,\n \ttxbd_tmp.buf_len = cpu_to_le16(hdr_len);\n \n \t/* first BD needs frm_len and offload flags set */\n-\ttxbd_tmp.frm_len = cpu_to_le16(hdr_len + data_len);\n+\ttxbd_tmp.frm_len = cpu_to_le16(frm_len);\n \ttxbd_tmp.flags = flags;\n \n \t/* For the TSO header we do not set the dma address since we do not\n@@ -616,6 +624,23 @@ static int enetc_map_tx_tso_data(struct enetc_bdr *tx_ring, struct sk_buff *skb,\n \treturn 0;\n }\n \n+/* Append a zero-padding BD to a frame shorter than ETH_ZLEN */\n+static void enetc_map_tx_pad(struct enetc_bdr *tx_ring, int i, int pad_len)\n+{\n+\tstruct enetc_tx_swbd *tx_swbd = \u0026tx_ring-\u003etx_swbd[i];\n+\tunion enetc_tx_bd *txbd = ENETC_TXBD(*tx_ring, i);\n+\n+\tenetc_clear_tx_bd(txbd);\n+\ttxbd-\u003eaddr = cpu_to_le64(tx_ring-\u003etx_pad_dma);\n+\ttxbd-\u003ebuf_len = cpu_to_le16(pad_len);\n+\ttxbd-\u003eflags = ENETC_TXBD_FLAGS_F;\n+\n+\ttx_swbd-\u003elen = pad_len;\n+\ttx_swbd-\u003eis_eof = 1;\n+\ttx_swbd-\u003edo_twostep_tstamp = false;\n+\ttx_swbd-\u003echeck_wb = false;\n+}\n+\n static __wsum enetc_tso_hdr_csum(struct tso_t *tso, struct sk_buff *skb,\n \t\t\t\t char *hdr, int hdr_len, int *l4_hdr_len)\n {\n@@ -918,6 +943,8 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb\n \ti = tx_ring-\u003enext_to_use;\n \n \twhile (total_len \u003e 0) {\n+\t\tint frm_len;\n+\t\tint pad_len;\n \t\tchar *hdr;\n \n \t\t/* Get the BD */\n@@ -929,6 +956,10 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb\n \t\tdata_len = min_t(int, skb_shinfo(skb)-\u003egso_size, total_len);\n \t\ttotal_len -= data_len;\n \n+\t\t/* Pad segments below ETH_ZLEN so the mEMAC does not pad them. */\n+\t\tfrm_len = max_t(int, hdr_len + data_len, ETH_ZLEN);\n+\t\tpad_len = frm_len - (hdr_len + data_len);\n+\n \t\t/* prepare packet headers: MAC + IP + TCP */\n \t\thdr = tx_ring-\u003etso_headers + i * TSO_HEADER_SIZE;\n \t\ttso_build_hdr(skb, hdr, \u0026tso, data_len, total_len == 0);\n@@ -936,7 +967,7 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb\n \t\t/* compute the csum over the L4 header */\n \t\tcsum = enetc_tso_hdr_csum(\u0026tso, skb, hdr, hdr_len, \u0026pos);\n \t\tcount += enetc_map_tx_tso_hdr(tx_ring, skb, tx_swbd, txbd,\n-\t\t\t\t\t      \u0026i, hdr_len, data_len);\n+\t\t\t\t\t      \u0026i, hdr_len, data_len, frm_len);\n \t\tbd_data_num = 0;\n \n \t\twhile (data_len \u003e 0) {\n@@ -958,8 +989,10 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb\n \t\t\tcsum = csum_block_add(csum, csum2, pos);\n \t\t\tpos += size;\n \n+\t\t\t/* When padding, the pad BD is the last one, not this */\n \t\t\terr = enetc_map_tx_tso_data(tx_ring, skb, tx_swbd, txbd,\n \t\t\t\t\t\t    tso.data, size,\n+\t\t\t\t\t\t    !pad_len \u0026\u0026\n \t\t\t\t\t\t    size == data_len);\n \t\t\tif (err) {\n \t\t\t\tif (i == 0)\n@@ -980,6 +1013,13 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb\n \n \t\tenetc_tso_complete_csum(tx_ring, \u0026tso, skb, hdr, pos, csum);\n \n+\t\tif (pad_len) {\n+\t\t\tenetc_bdr_idx_inc(tx_ring, \u0026i);\n+\t\t\tenetc_map_tx_pad(tx_ring, i, pad_len);\n+\t\t\ttx_swbd = \u0026tx_ring-\u003etx_swbd[i];\n+\t\t\tcount++;\n+\t\t}\n+\n \t\tif (total_len == 0)\n \t\t\ttx_swbd-\u003eskb = skb;\n \n@@ -1032,7 +1072,9 @@ static netdev_tx_t enetc_start_xmit(struct sk_buff *skb,\n \n \t\t\tcount = enetc_lso_hw_offload(tx_ring, skb);\n \t\t} else {\n-\t\t\tif (enetc_bd_unused(tx_ring) \u003c tso_count_descs(skb)) {\n+\t\t\t/* +gso_segs to cover one pad BD per segment */\n+\t\t\tif (enetc_bd_unused(tx_ring) \u003c tso_count_descs(skb) +\n+\t\t\t    skb_shinfo(skb)-\u003egso_segs) {\n \t\t\t\tnetif_stop_subqueue(ndev, tx_ring-\u003eindex);\n \t\t\t\treturn NETDEV_TX_BUSY;\n \t\t\t}\n@@ -1042,6 +1084,15 @@ static netdev_tx_t enetc_start_xmit(struct sk_buff *skb,\n \t\t\tenetc_unlock_mdio();\n \t\t}\n \t} else {\n+\t\tif (eth_skb_pad(skb))\n+\t\t\treturn NETDEV_TX_OK;\n+\n+\t\tif (unlikely(skb_headlen(skb) \u003c ENETC_MIN_BUFF_SIZE \u0026\u0026\n+\t\t\t     !pskb_may_pull(skb, ENETC_MIN_BUFF_SIZE))) {\n+\t\t\tdev_kfree_skb_any(skb);\n+\t\t\treturn NETDEV_TX_OK;\n+\t\t}\n+\n \t\tif (unlikely(skb_shinfo(skb)-\u003enr_frags \u003e priv-\u003emax_frags))\n \t\t\tif (unlikely(skb_linearize(skb)))\n \t\t\t\tgoto drop_packet_err;\n@@ -1707,8 +1758,11 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,\n {\n \tstruct enetc_tx_swbd *tmp_tx_swbd = xdp_tx_arr;\n \tint i, k, frm_len = tmp_tx_swbd-\u003elen;\n+\tstruct enetc_tx_swbd *last_swbd;\n+\tint pad_len;\n \n-\tif (unlikely(enetc_bd_unused(tx_ring) \u003c ENETC_TXBDS_NEEDED(num_tx_swbd)))\n+\t/* Hardware does not support a first buffer size of less than 16 bytes */\n+\tif (unlikely(xdp_tx_arr[0].len \u003c ENETC_MIN_BUFF_SIZE))\n \t\treturn false;\n \n \twhile (unlikely(!tmp_tx_swbd-\u003eis_eof)) {\n@@ -1716,15 +1770,24 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,\n \t\tfrm_len += tmp_tx_swbd-\u003elen;\n \t}\n \n+\t/* Pad frames below ETH_ZLEN so the mEMAC does not pad them. */\n+\tpad_len = max_t(int, ETH_ZLEN - frm_len, 0);\n+\n+\tif (unlikely(enetc_bd_unused(tx_ring) \u003c\n+\t\t     ENETC_TXBDS_NEEDED(num_tx_swbd + !!pad_len)))\n+\t\treturn false;\n+\n \ti = tx_ring-\u003enext_to_use;\n \n \tfor (k = 0; k \u003c num_tx_swbd; k++) {\n \t\tstruct enetc_tx_swbd *xdp_tx_swbd = \u0026xdp_tx_arr[k];\n \n-\t\tenetc_xdp_map_tx_buff(tx_ring, i, xdp_tx_swbd, frm_len);\n+\t\tenetc_xdp_map_tx_buff(tx_ring, i, xdp_tx_swbd,\n+\t\t\t\t      frm_len + pad_len);\n+\t\tlast_swbd = \u0026tx_ring-\u003etx_swbd[i];\n \n-\t\t/* last BD needs 'F' bit set */\n-\t\tif (xdp_tx_swbd-\u003eis_eof) {\n+\t\t/* last BD needs 'F' bit set, unless a pad BD follows */\n+\t\tif (xdp_tx_swbd-\u003eis_eof \u0026\u0026 !pad_len) {\n \t\t\tunion enetc_tx_bd *txbd = ENETC_TXBD(*tx_ring, i);\n \n \t\t\ttxbd-\u003eflags = ENETC_TXBD_FLAGS_F;\n@@ -1733,6 +1796,22 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,\n \t\tenetc_bdr_idx_inc(tx_ring, \u0026i);\n \t}\n \n+\t/* The pad BD becomes the last one, so it takes over the xdp_frame\n+\t * (if any) from the last data BD. The pad BD has no DMA mapping of\n+\t * its own, and it is not an XDP_TX buffer to be recycled.\n+\t */\n+\tif (unlikely(pad_len)) {\n+\t\tstruct enetc_tx_swbd *pad_swbd = \u0026tx_ring-\u003etx_swbd[i];\n+\n+\t\tenetc_map_tx_pad(tx_ring, i, pad_len);\n+\t\tpad_swbd-\u003eis_xdp_redirect = last_swbd-\u003eis_xdp_redirect;\n+\t\tpad_swbd-\u003exdp_frame = last_swbd-\u003exdp_frame;\n+\t\tlast_swbd-\u003exdp_frame = NULL;\n+\t\tlast_swbd-\u003eis_eof = false;\n+\n+\t\tenetc_bdr_idx_inc(tx_ring, \u0026i);\n+\t}\n+\n \ttx_ring-\u003enext_to_use = i;\n \n \treturn true;\n@@ -1812,17 +1891,21 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,\n \tstruct enetc_ndev_priv *priv = netdev_priv(ndev);\n \tstruct skb_shared_info *shinfo;\n \tstruct enetc_bdr *tx_ring;\n-\tint xdp_tx_bd_cnt, i, k;\n-\tint xdp_tx_frm_cnt = 0;\n+\tint xdp_tx_bd_cnt;\n+\tint i, k = 0;\n+\tint err = 0;\n+\n+\ttx_ring = priv-\u003exdp_tx_ring[smp_processor_id()];\n+\tspin_lock(\u0026tx_ring-\u003exdp_lock);\n \n \tif (unlikely(test_bit(ENETC_TX_DOWN, \u0026priv-\u003eflags) ||\n-\t\t     !netif_carrier_ok(ndev)))\n-\t\treturn -ENETDOWN;\n+\t\t     !netif_carrier_ok(ndev))) {\n+\t\terr = -ENETDOWN;\n+\t\tgoto out;\n+\t}\n \n \tenetc_lock_mdio();\n \n-\ttx_ring = priv-\u003exdp_tx_ring[smp_processor_id()];\n-\n \tprefetchw(ENETC_TXBD(*tx_ring, tx_ring-\u003enext_to_use));\n \n \tfor (k = 0; k \u003c num_frames; k++) {\n@@ -1843,21 +1926,22 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,\n \t\t\tfor (i = 0; i \u003c xdp_tx_bd_cnt; i++)\n \t\t\t\tenetc_unmap_tx_buff(tx_ring,\n \t\t\t\t\t\t    \u0026xdp_redirect_arr[i]);\n-\t\t\ttx_ring-\u003estats.xdp_tx_drops++;\n \t\t\tbreak;\n \t\t}\n-\n-\t\txdp_tx_frm_cnt++;\n \t}\n \n-\tif (unlikely((flags \u0026 XDP_XMIT_FLUSH) || k != xdp_tx_frm_cnt))\n+\tif (unlikely(k \u0026\u0026 ((flags \u0026 XDP_XMIT_FLUSH) || k \u003c num_frames)))\n \t\tenetc_update_tx_ring_tail(tx_ring);\n \n-\ttx_ring-\u003estats.xdp_tx += xdp_tx_frm_cnt;\n-\n \tenetc_unlock_mdio();\n \n-\treturn xdp_tx_frm_cnt;\n+out:\n+\ttx_ring-\u003estats.xdp_tx += k;\n+\ttx_ring-\u003estats.xdp_tx_drops += num_frames - k;\n+\n+\tspin_unlock(\u0026tx_ring-\u003exdp_lock);\n+\n+\treturn err ?: k;\n }\n EXPORT_SYMBOL_GPL(enetc_xdp_xmit);\n \n@@ -1997,6 +2081,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,\n \t/* next descriptor to process */\n \ti = rx_ring-\u003enext_to_clean;\n \n+\ttx_ring = priv-\u003exdp_tx_ring[rx_ring-\u003eindex];\n+\tspin_lock(\u0026tx_ring-\u003exdp_lock);\n+\n \tenetc_lock_mdio();\n \n \twhile (likely(rx_frm_cnt \u003c work_limit)) {\n@@ -2063,11 +2150,12 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,\n \t\t\tenetc_bulk_flip_buff(rx_ring, orig_i, i);\n \n \t\t\tenetc_unlock_mdio();\n+\t\t\tspin_unlock(\u0026tx_ring-\u003exdp_lock);\n \t\t\tnapi_gro_receive(napi, skb);\n+\t\t\tspin_lock(\u0026tx_ring-\u003exdp_lock);\n \t\t\tenetc_lock_mdio();\n \t\t\tbreak;\n \t\tcase XDP_TX:\n-\t\t\ttx_ring = priv-\u003exdp_tx_ring[rx_ring-\u003eindex];\n \t\t\tif (unlikely(test_bit(ENETC_TX_DOWN, \u0026priv-\u003eflags))) {\n \t\t\t\tenetc_xdp_drop(rx_ring, orig_i, i);\n \t\t\t\ttx_ring-\u003estats.xdp_tx_drops++;\n@@ -2100,7 +2188,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,\n \t\t\tbreak;\n \t\tcase XDP_REDIRECT:\n \t\t\tenetc_unlock_mdio();\n+\t\t\tspin_unlock(\u0026tx_ring-\u003exdp_lock);\n+\n \t\t\terr = xdp_do_redirect(rx_ring-\u003endev, \u0026xdp_buff, prog);\n+\n+\t\t\tspin_lock(\u0026tx_ring-\u003exdp_lock);\n \t\t\tenetc_lock_mdio();\n \t\t\tif (unlikely(err)) {\n \t\t\t\tenetc_xdp_drop(rx_ring, orig_i, i);\n@@ -2116,6 +2208,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,\n \t}\n \n out:\n+\tspin_unlock(\u0026tx_ring-\u003exdp_lock);\n+\n \trx_ring-\u003enext_to_clean = i;\n \n \trx_ring-\u003estats.packets += rx_frm_cnt;\n@@ -2127,8 +2221,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,\n \t\tenetc_lock_mdio();\n \t}\n \n-\tif (xdp_tx_frm_cnt)\n+\tif (xdp_tx_frm_cnt) {\n+\t\tspin_lock(\u0026tx_ring-\u003exdp_lock);\n \t\tenetc_update_tx_ring_tail(tx_ring);\n+\t\tspin_unlock(\u0026tx_ring-\u003exdp_lock);\n+\t}\n \n \tif (cleaned_cnt \u003e rx_ring-\u003exdp.xdp_tx_in_flight)\n \t\tenetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring) -\n@@ -2277,8 +2374,18 @@ static int enetc_alloc_tx_resource(struct enetc_bdr_resource *res,\n \t\tgoto err_alloc_tso;\n \t}\n \n+\tres-\u003etx_pad = dma_alloc_coherent(dev, ETH_ZLEN, \u0026res-\u003etx_pad_dma,\n+\t\t\t\t\t GFP_KERNEL);\n+\tif (!res-\u003etx_pad) {\n+\t\terr = -ENOMEM;\n+\t\tgoto err_alloc_pad;\n+\t}\n+\n \treturn 0;\n \n+err_alloc_pad:\n+\tdma_free_coherent(dev, bd_count * TSO_HEADER_SIZE, res-\u003etso_headers,\n+\t\t\t  res-\u003etso_headers_dma);\n err_alloc_tso:\n \tenetc_dma_free_bdr(res);\n err_alloc_bdr:\n@@ -2290,6 +2397,7 @@ static int enetc_alloc_tx_resource(struct enetc_bdr_resource *res,\n \n static void enetc_free_tx_resource(const struct enetc_bdr_resource *res)\n {\n+\tdma_free_coherent(res-\u003edev, ETH_ZLEN, res-\u003etx_pad, res-\u003etx_pad_dma);\n \tdma_free_coherent(res-\u003edev, res-\u003ebd_count * TSO_HEADER_SIZE,\n \t\t\t  res-\u003etso_headers, res-\u003etso_headers_dma);\n \tenetc_dma_free_bdr(res);\n@@ -2417,6 +2525,8 @@ static void enetc_assign_tx_resource(struct enetc_bdr *tx_ring,\n \ttx_ring-\u003etx_swbd = res ? res-\u003etx_swbd : NULL;\n \ttx_ring-\u003etso_headers = res ? res-\u003etso_headers : NULL;\n \ttx_ring-\u003etso_headers_dma = res ? res-\u003etso_headers_dma : 0;\n+\ttx_ring-\u003etx_pad = res ? res-\u003etx_pad : NULL;\n+\ttx_ring-\u003etx_pad_dma = res ? res-\u003etx_pad_dma : 0;\n }\n \n static void enetc_assign_rx_resource(struct enetc_bdr *rx_ring,\n@@ -2630,7 +2740,8 @@ static void enetc_setup_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)\n \t * adjust sw indexes\n \t */\n \ttx_ring-\u003enext_to_use = enetc_txbdr_rd(hw, idx, ENETC_TBPIR);\n-\ttx_ring-\u003enext_to_clean = enetc_txbdr_rd(hw, idx, ENETC_TBCIR);\n+\ttx_ring-\u003enext_to_clean = enetc_txbdr_rd(hw, idx, ENETC_TBCIR) \u0026\n+\t\t\t\t ENETC_TBCIR_IDX_MASK;\n \n \tif (tx_ring-\u003enext_to_use != tx_ring-\u003enext_to_clean \u0026\u0026\n \t    !is_enetc_rev1(si)) {\n@@ -3554,6 +3665,7 @@ static int enetc_int_vector_init(struct enetc_ndev_priv *priv, int i,\n \t\tidx = priv-\u003ebdr_int_num * j + i;\n \t\t__set_bit(idx, \u0026v-\u003etx_rings_map);\n \t\tbdr = \u0026v-\u003etx_ring[j];\n+\t\tspin_lock_init(\u0026bdr-\u003exdp_lock);\n \t\tbdr-\u003eindex = idx;\n \t\tbdr-\u003endev = priv-\u003endev;\n \t\tbdr-\u003edev = priv-\u003edev;\ndiff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h\nindex d1e9d91300575..2ec0518185749 100644\n--- a/drivers/net/ethernet/freescale/enetc/enetc.h\n+++ b/drivers/net/ethernet/freescale/enetc/enetc.h\n@@ -22,6 +22,8 @@\n #define ENETC_MAX_MTU\t\t(ENETC_MAC_MAXFRM_SIZE - \\\n \t\t\t\t(ETH_FCS_LEN + ETH_HLEN + VLAN_HLEN))\n \n+#define ENETC_MIN_BUFF_SIZE\t16\n+\n #define ENETC_CBD_DATA_MEM_ALIGN 64\n \n #define ENETC_MADDR_HASH_TBL_SZ\t64\n@@ -144,6 +146,8 @@ struct enetc_bdr_resource {\n \t};\n \tchar *tso_headers;\n \tdma_addr_t tso_headers_dma;\n+\tvoid *tx_pad;\n+\tdma_addr_t tx_pad_dma;\n };\n \n struct enetc_bdr {\n@@ -170,6 +174,10 @@ struct enetc_bdr {\n \tvoid __iomem *idr; /* Interrupt Detect Register pointer */\n \n \tint buffer_offset;\n+\n+\t/* Serialize NAPI and ndo_xdp_xmit() targeting the same TX ring */\n+\tspinlock_t xdp_lock;\n+\n \tstruct enetc_xdp_data xdp;\n \n \tstruct enetc_ring_stats stats;\n@@ -181,6 +189,10 @@ struct enetc_bdr {\n \t/* DMA buffer for TSO headers */\n \tchar *tso_headers;\n \tdma_addr_t tso_headers_dma;\n+\n+\t/* Shared read-only zero buffer to pad short frames to ETH_ZLEN */\n+\tvoid *tx_pad;\n+\tdma_addr_t tx_pad_dma;\n } ____cacheline_aligned_in_smp;\n \n static inline void enetc_bdr_idx_inc(struct enetc_bdr *bdr, int *i)\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the NXP/Freescale ENETC ethernet controller driver (drivers/net/ethernet/freescale/enetc/), adjusting TX frame padding, TSO handling, and XDP locking. ENETC is an integrated controller found on NXP SoCs (e.g., LS1028A, i.MX95) and requires physical hardware not emulated in standard QEMU/GCE virtualized test environments on amd64. Therefore, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 53aef6fcdf2e638127935357ffa45ef65c2d8d01
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Oct 15 13:47:53 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index 80f0082f6c633..3003a415418ba 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -168,6 +168,14 @@ static void enetc_free_tx_frame(struct enetc_bdr *tx_ring,
 
 	if (tx_swbd->dma)
 		enetc_unmap_tx_buff(tx_ring, tx_swbd);
+	if (tx_swbd->is_xdp_tx) {
+		struct enetc_ndev_priv *priv = netdev_priv(tx_ring->ndev);
+		struct enetc_bdr *rx_ring;
+
+		rx_ring = enetc_rx_ring_from_xdp_tx_ring(priv, tx_ring);
+		rx_ring->xdp.xdp_tx_in_flight--;
+		__free_page(tx_swbd->page);
+	}
 
 	if (xdp_frame) {
 		xdp_return_frame(tx_swbd->xdp_frame);
@@ -527,7 +535,7 @@ static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb)
 static int enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb,
 				struct enetc_tx_swbd *tx_swbd,
 				union enetc_tx_bd *txbd, int *i, int hdr_len,
-				int data_len)
+				int data_len, int frm_len)
 {
 	union enetc_tx_bd txbd_tmp;
 	u8 flags = 0, e_flags = 0;
@@ -544,7 +552,7 @@ static int enetc_map_tx_tso_hdr(struct enetc_bdr *tx_ring, struct sk_buff *skb,
 	txbd_tmp.buf_len = cpu_to_le16(hdr_len);
 
 	/* first BD needs frm_len and offload flags set */
-	txbd_tmp.frm_len = cpu_to_le16(hdr_len + data_len);
+	txbd_tmp.frm_len = cpu_to_le16(frm_len);
 	txbd_tmp.flags = flags;
 
 	/* For the TSO header we do not set the dma address since we do not
@@ -616,6 +624,23 @@ static int enetc_map_tx_tso_data(struct enetc_bdr *tx_ring, struct sk_buff *skb,
 	return 0;
 }
 
+/* Append a zero-padding BD to a frame shorter than ETH_ZLEN */
+static void enetc_map_tx_pad(struct enetc_bdr *tx_ring, int i, int pad_len)
+{
+	struct enetc_tx_swbd *tx_swbd = &tx_ring->tx_swbd[i];
+	union enetc_tx_bd *txbd = ENETC_TXBD(*tx_ring, i);
+
+	enetc_clear_tx_bd(txbd);
+	txbd->addr = cpu_to_le64(tx_ring->tx_pad_dma);
+	txbd->buf_len = cpu_to_le16(pad_len);
+	txbd->flags = ENETC_TXBD_FLAGS_F;
+
+	tx_swbd->len = pad_len;
+	tx_swbd->is_eof = 1;
+	tx_swbd->do_twostep_tstamp = false;
+	tx_swbd->check_wb = false;
+}
+
 static __wsum enetc_tso_hdr_csum(struct tso_t *tso, struct sk_buff *skb,
 				 char *hdr, int hdr_len, int *l4_hdr_len)
 {
@@ -918,6 +943,8 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb
 	i = tx_ring->next_to_use;
 
 	while (total_len > 0) {
+		int frm_len;
+		int pad_len;
 		char *hdr;
 
 		/* Get the BD */
@@ -929,6 +956,10 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb
 		data_len = min_t(int, skb_shinfo(skb)->gso_size, total_len);
 		total_len -= data_len;
 
+		/* Pad segments below ETH_ZLEN so the mEMAC does not pad them. */
+		frm_len = max_t(int, hdr_len + data_len, ETH_ZLEN);
+		pad_len = frm_len - (hdr_len + data_len);
+
 		/* prepare packet headers: MAC + IP + TCP */
 		hdr = tx_ring->tso_headers + i * TSO_HEADER_SIZE;
 		tso_build_hdr(skb, hdr, &tso, data_len, total_len == 0);
@@ -936,7 +967,7 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb
 		/* compute the csum over the L4 header */
 		csum = enetc_tso_hdr_csum(&tso, skb, hdr, hdr_len, &pos);
 		count += enetc_map_tx_tso_hdr(tx_ring, skb, tx_swbd, txbd,
-					      &i, hdr_len, data_len);
+					      &i, hdr_len, data_len, frm_len);
 		bd_data_num = 0;
 
 		while (data_len > 0) {
@@ -958,8 +989,10 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb
 			csum = csum_block_add(csum, csum2, pos);
 			pos += size;
 
+			/* When padding, the pad BD is the last one, not this */
 			err = enetc_map_tx_tso_data(tx_ring, skb, tx_swbd, txbd,
 						    tso.data, size,
+						    !pad_len &&
 						    size == data_len);
 			if (err) {
 				if (i == 0)
@@ -980,6 +1013,13 @@ static int enetc_map_tx_tso_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb
 
 		enetc_tso_complete_csum(tx_ring, &tso, skb, hdr, pos, csum);
 
+		if (pad_len) {
+			enetc_bdr_idx_inc(tx_ring, &i);
+			enetc_map_tx_pad(tx_ring, i, pad_len);
+			tx_swbd = &tx_ring->tx_swbd[i];
+			count++;
+		}
+
 		if (total_len == 0)
 			tx_swbd->skb = skb;
 
@@ -1032,7 +1072,9 @@ static netdev_tx_t enetc_start_xmit(struct sk_buff *skb,
 
 			count = enetc_lso_hw_offload(tx_ring, skb);
 		} else {
-			if (enetc_bd_unused(tx_ring) < tso_count_descs(skb)) {
+			/* +gso_segs to cover one pad BD per segment */
+			if (enetc_bd_unused(tx_ring) < tso_count_descs(skb) +
+			    skb_shinfo(skb)->gso_segs) {
 				netif_stop_subqueue(ndev, tx_ring->index);
 				return NETDEV_TX_BUSY;
 			}
@@ -1042,6 +1084,15 @@ static netdev_tx_t enetc_start_xmit(struct sk_buff *skb,
 			enetc_unlock_mdio();
 		}
 	} else {
+		if (eth_skb_pad(skb))
+			return NETDEV_TX_OK;
+
+		if (unlikely(skb_headlen(skb) < ENETC_MIN_BUFF_SIZE &&
+			     !pskb_may_pull(skb, ENETC_MIN_BUFF_SIZE))) {
+			dev_kfree_skb_any(skb);
+			return NETDEV_TX_OK;
+		}
+
 		if (unlikely(skb_shinfo(skb)->nr_frags > priv->max_frags))
 			if (unlikely(skb_linearize(skb)))
 				goto drop_packet_err;
@@ -1707,8 +1758,11 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,
 {
 	struct enetc_tx_swbd *tmp_tx_swbd = xdp_tx_arr;
 	int i, k, frm_len = tmp_tx_swbd->len;
+	struct enetc_tx_swbd *last_swbd;
+	int pad_len;
 
-	if (unlikely(enetc_bd_unused(tx_ring) < ENETC_TXBDS_NEEDED(num_tx_swbd)))
+	/* Hardware does not support a first buffer size of less than 16 bytes */
+	if (unlikely(xdp_tx_arr[0].len < ENETC_MIN_BUFF_SIZE))
 		return false;
 
 	while (unlikely(!tmp_tx_swbd->is_eof)) {
@@ -1716,15 +1770,24 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,
 		frm_len += tmp_tx_swbd->len;
 	}
 
+	/* Pad frames below ETH_ZLEN so the mEMAC does not pad them. */
+	pad_len = max_t(int, ETH_ZLEN - frm_len, 0);
+
+	if (unlikely(enetc_bd_unused(tx_ring) <
+		     ENETC_TXBDS_NEEDED(num_tx_swbd + !!pad_len)))
+		return false;
+
 	i = tx_ring->next_to_use;
 
 	for (k = 0; k < num_tx_swbd; k++) {
 		struct enetc_tx_swbd *xdp_tx_swbd = &xdp_tx_arr[k];
 
-		enetc_xdp_map_tx_buff(tx_ring, i, xdp_tx_swbd, frm_len);
+		enetc_xdp_map_tx_buff(tx_ring, i, xdp_tx_swbd,
+				      frm_len + pad_len);
+		last_swbd = &tx_ring->tx_swbd[i];
 
-		/* last BD needs 'F' bit set */
-		if (xdp_tx_swbd->is_eof) {
+		/* last BD needs 'F' bit set, unless a pad BD follows */
+		if (xdp_tx_swbd->is_eof && !pad_len) {
 			union enetc_tx_bd *txbd = ENETC_TXBD(*tx_ring, i);
 
 			txbd->flags = ENETC_TXBD_FLAGS_F;
@@ -1733,6 +1796,22 @@ static bool enetc_xdp_tx(struct enetc_bdr *tx_ring,
 		enetc_bdr_idx_inc(tx_ring, &i);
 	}
 
+	/* The pad BD becomes the last one, so it takes over the xdp_frame
+	 * (if any) from the last data BD. The pad BD has no DMA mapping of
+	 * its own, and it is not an XDP_TX buffer to be recycled.
+	 */
+	if (unlikely(pad_len)) {
+		struct enetc_tx_swbd *pad_swbd = &tx_ring->tx_swbd[i];
+
+		enetc_map_tx_pad(tx_ring, i, pad_len);
+		pad_swbd->is_xdp_redirect = last_swbd->is_xdp_redirect;
+		pad_swbd->xdp_frame = last_swbd->xdp_frame;
+		last_swbd->xdp_frame = NULL;
+		last_swbd->is_eof = false;
+
+		enetc_bdr_idx_inc(tx_ring, &i);
+	}
+
 	tx_ring->next_to_use = i;
 
 	return true;
@@ -1812,17 +1891,21 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
 	struct enetc_ndev_priv *priv = netdev_priv(ndev);
 	struct skb_shared_info *shinfo;
 	struct enetc_bdr *tx_ring;
-	int xdp_tx_bd_cnt, i, k;
-	int xdp_tx_frm_cnt = 0;
+	int xdp_tx_bd_cnt;
+	int i, k = 0;
+	int err = 0;
+
+	tx_ring = priv->xdp_tx_ring[smp_processor_id()];
+	spin_lock(&tx_ring->xdp_lock);
 
 	if (unlikely(test_bit(ENETC_TX_DOWN, &priv->flags) ||
-		     !netif_carrier_ok(ndev)))
-		return -ENETDOWN;
+		     !netif_carrier_ok(ndev))) {
+		err = -ENETDOWN;
+		goto out;
+	}
 
 	enetc_lock_mdio();
 
-	tx_ring = priv->xdp_tx_ring[smp_processor_id()];
-
 	prefetchw(ENETC_TXBD(*tx_ring, tx_ring->next_to_use));
 
 	for (k = 0; k < num_frames; k++) {
@@ -1843,21 +1926,22 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
 			for (i = 0; i < xdp_tx_bd_cnt; i++)
 				enetc_unmap_tx_buff(tx_ring,
 						    &xdp_redirect_arr[i]);
-			tx_ring->stats.xdp_tx_drops++;
 			break;
 		}
-
-		xdp_tx_frm_cnt++;
 	}
 
-	if (unlikely((flags & XDP_XMIT_FLUSH) || k != xdp_tx_frm_cnt))
+	if (unlikely(k && ((flags & XDP_XMIT_FLUSH) || k < num_frames)))
 		enetc_update_tx_ring_tail(tx_ring);
 
-	tx_ring->stats.xdp_tx += xdp_tx_frm_cnt;
-
 	enetc_unlock_mdio();
 
-	return xdp_tx_frm_cnt;
+out:
+	tx_ring->stats.xdp_tx += k;
+	tx_ring->stats.xdp_tx_drops += num_frames - k;
+
+	spin_unlock(&tx_ring->xdp_lock);
+
+	return err ?: k;
 }
 EXPORT_SYMBOL_GPL(enetc_xdp_xmit);
 
@@ -1997,6 +2081,9 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
 	/* next descriptor to process */
 	i = rx_ring->next_to_clean;
 
+	tx_ring = priv->xdp_tx_ring[rx_ring->index];
+	spin_lock(&tx_ring->xdp_lock);
+
 	enetc_lock_mdio();
 
 	while (likely(rx_frm_cnt < work_limit)) {
@@ -2063,11 +2150,12 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
 			enetc_bulk_flip_buff(rx_ring, orig_i, i);
 
 			enetc_unlock_mdio();
+			spin_unlock(&tx_ring->xdp_lock);
 			napi_gro_receive(napi, skb);
+			spin_lock(&tx_ring->xdp_lock);
 			enetc_lock_mdio();
 			break;
 		case XDP_TX:
-			tx_ring = priv->xdp_tx_ring[rx_ring->index];
 			if (unlikely(test_bit(ENETC_TX_DOWN, &priv->flags))) {
 				enetc_xdp_drop(rx_ring, orig_i, i);
 				tx_ring->stats.xdp_tx_drops++;
@@ -2100,7 +2188,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
 			break;
 		case XDP_REDIRECT:
 			enetc_unlock_mdio();
+			spin_unlock(&tx_ring->xdp_lock);
+
 			err = xdp_do_redirect(rx_ring->ndev, &xdp_buff, prog);
+
+			spin_lock(&tx_ring->xdp_lock);
 			enetc_lock_mdio();
 			if (unlikely(err)) {
 				enetc_xdp_drop(rx_ring, orig_i, i);
@@ -2116,6 +2208,8 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
 	}
 
 out:
+	spin_unlock(&tx_ring->xdp_lock);
+
 	rx_ring->next_to_clean = i;
 
 	rx_ring->stats.packets += rx_frm_cnt;
@@ -2127,8 +2221,11 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
 		enetc_lock_mdio();
 	}
 
-	if (xdp_tx_frm_cnt)
+	if (xdp_tx_frm_cnt) {
+		spin_lock(&tx_ring->xdp_lock);
 		enetc_update_tx_ring_tail(tx_ring);
+		spin_unlock(&tx_ring->xdp_lock);
+	}
 
 	if (cleaned_cnt > rx_ring->xdp.xdp_tx_in_flight)
 		enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring) -
@@ -2277,8 +2374,18 @@ static int enetc_alloc_tx_resource(struct enetc_bdr_resource *res,
 		goto err_alloc_tso;
 	}
 
+	res->tx_pad = dma_alloc_coherent(dev, ETH_ZLEN, &res->tx_pad_dma,
+					 GFP_KERNEL);
+	if (!res->tx_pad) {
+		err = -ENOMEM;
+		goto err_alloc_pad;
+	}
+
 	return 0;
 
+err_alloc_pad:
+	dma_free_coherent(dev, bd_count * TSO_HEADER_SIZE, res->tso_headers,
+			  res->tso_headers_dma);
 err_alloc_tso:
 	enetc_dma_free_bdr(res);
 err_alloc_bdr:
@@ -2290,6 +2397,7 @@ static int enetc_alloc_tx_resource(struct enetc_bdr_resource *res,
 
 static void enetc_free_tx_resource(const struct enetc_bdr_resource *res)
 {
+	dma_free_coherent(res->dev, ETH_ZLEN, res->tx_pad, res->tx_pad_dma);
 	dma_free_coherent(res->dev, res->bd_count * TSO_HEADER_SIZE,
 			  res->tso_headers, res->tso_headers_dma);
 	enetc_dma_free_bdr(res);
@@ -2417,6 +2525,8 @@ static void enetc_assign_tx_resource(struct enetc_bdr *tx_ring,
 	tx_ring->tx_swbd = res ? res->tx_swbd : NULL;
 	tx_ring->tso_headers = res ? res->tso_headers : NULL;
 	tx_ring->tso_headers_dma = res ? res->tso_headers_dma : 0;
+	tx_ring->tx_pad = res ? res->tx_pad : NULL;
+	tx_ring->tx_pad_dma = res ? res->tx_pad_dma : 0;
 }
 
 static void enetc_assign_rx_resource(struct enetc_bdr *rx_ring,
@@ -2630,7 +2740,8 @@ static void enetc_setup_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)
 	 * adjust sw indexes
 	 */
 	tx_ring->next_to_use = enetc_txbdr_rd(hw, idx, ENETC_TBPIR);
-	tx_ring->next_to_clean = enetc_txbdr_rd(hw, idx, ENETC_TBCIR);
+	tx_ring->next_to_clean = enetc_txbdr_rd(hw, idx, ENETC_TBCIR) &
+				 ENETC_TBCIR_IDX_MASK;
 
 	if (tx_ring->next_to_use != tx_ring->next_to_clean &&
 	    !is_enetc_rev1(si)) {
@@ -3554,6 +3665,7 @@ static int enetc_int_vector_init(struct enetc_ndev_priv *priv, int i,
 		idx = priv->bdr_int_num * j + i;
 		__set_bit(idx, &v->tx_rings_map);
 		bdr = &v->tx_ring[j];
+		spin_lock_init(&bdr->xdp_lock);
 		bdr->index = idx;
 		bdr->ndev = priv->ndev;
 		bdr->dev = priv->dev;
diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
index d1e9d91300575..2ec0518185749 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc.h
@@ -22,6 +22,8 @@
 #define ENETC_MAX_MTU		(ENETC_MAC_MAXFRM_SIZE - \
 				(ETH_FCS_LEN + ETH_HLEN + VLAN_HLEN))
 
+#define ENETC_MIN_BUFF_SIZE	16
+
 #define ENETC_CBD_DATA_MEM_ALIGN 64
 
 #define ENETC_MADDR_HASH_TBL_SZ	64
@@ -144,6 +146,8 @@ struct enetc_bdr_resource {
 	};
 	char *tso_headers;
 	dma_addr_t tso_headers_dma;
+	void *tx_pad;
+	dma_addr_t tx_pad_dma;
 };
 
 struct enetc_bdr {
@@ -170,6 +174,10 @@ struct enetc_bdr {
 	void __iomem *idr; /* Interrupt Detect Register pointer */
 
 	int buffer_offset;
+
+	/* Serialize NAPI and ndo_xdp_xmit() targeting the same TX ring */
+	spinlock_t xdp_lock;
+
 	struct enetc_xdp_data xdp;
 
 	struct enetc_ring_stats stats;
@@ -181,6 +189,10 @@ struct enetc_bdr {
 	/* DMA buffer for TSO headers */
 	char *tso_headers;
 	dma_addr_t tso_headers_dma;
+
+	/* Shared read-only zero buffer to pad short frames to ETH_ZLEN */
+	void *tx_pad;
+	dma_addr_t tx_pad_dma;
 } ____cacheline_aligned_in_smp;
 
 static inline void enetc_bdr_idx_inc(struct enetc_bdr *bdr, int *i)

gemini-3.8-flash

null

null

							input: 9349
							output: 37
							thoughts: 112
						

**Evaluating the Syzkaller Fuzzing Potential of This Patch**

Okay, so I need to decide if this patch is worth throwing at syzkaller. First, let's break it down. It looks like the changes are confined to `drivers/net/ethernet/freescale/enetc/enetc.c` and `enetc.h`. Alright, good sign. That narrows the focus considerably. Now, the real question is, what kind of beast is `enetc`? Is this a physical Ethernet driver, or something virtual? My immediate inclination is to check the relevant Kconfig or maybe just grep the source for PCI, platform, or similar keywords that'll give me a strong hint about its underlying architecture and how it's exposed to the system. That'll inform my decision. I need to know the attack surface.

{
  "Expression": "config FSL_ENETC",
  "PathPrefixes": [
    "drivers/net/ethernet/freescale/"
  ]
}

{
  "Output": "drivers/net/ethernet/freescale/enetc/Kconfig-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/ethernet/freescale/enetc/Kconfig:2:config FSL_ENETC_CORE\ndrivers/net/ethernet/freescale/enetc/Kconfig-3-\ttristate\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig=27=config NXP_NTMP\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-29-\ndrivers/net/ethernet/freescale/enetc/Kconfig:30:config FSL_ENETC\ndrivers/net/ethernet/freescale/enetc/Kconfig-31-\ttristate \"ENETC PF driver\"\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig=48=config NXP_ENETC4\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-65-\ndrivers/net/ethernet/freescale/enetc/Kconfig:66:config FSL_ENETC_VF\ndrivers/net/ethernet/freescale/enetc/Kconfig-67-\ttristate \"ENETC VF driver\"\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-80-\ndrivers/net/ethernet/freescale/enetc/Kconfig:81:config FSL_ENETC_IERB\ndrivers/net/ethernet/freescale/enetc/Kconfig-82-\ttristate \"ENETC IERB driver\"\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-88-\ndrivers/net/ethernet/freescale/enetc/Kconfig:89:config FSL_ENETC_MDIO\ndrivers/net/ethernet/freescale/enetc/Kconfig-90-\ttristate \"ENETC MDIO driver\"\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-97-\ndrivers/net/ethernet/freescale/enetc/Kconfig:98:config FSL_ENETC_PTP_CLOCK\ndrivers/net/ethernet/freescale/enetc/Kconfig-99-\ttristate \"ENETC PTP clock driver\"\n--\ndrivers/net/ethernet/freescale/enetc/Kconfig-109-\ndrivers/net/ethernet/freescale/enetc/Kconfig:110:config FSL_ENETC_QOS\ndrivers/net/ethernet/freescale/enetc/Kconfig-111-\tbool \"ENETC hardware Time-sensitive Network support\"\n"
}

gemini-3.8-flash

null

null

							input: 10318
							output: 41
							thoughts: 21
						

Here's a summary of my mental process:

**Diving into the ENETC Kconfig File**

Okay, time to get a handle on the Ethernet ENETC driver configuration. Let's start with `drivers/net/ethernet/freescale/enetc/Kconfig`. I need to understand the configuration options for this Freescale Ethernet controller. I'm looking for the key features, dependencies, and any platform-specific aspects that influence how this driver is compiled and integrated. I'm expecting to see things like: whether it supports different ENETC hardware versions, any feature flags for things like checksum offload, VLAN support, or jumbo frames. I want to identify any dependencies on other kernel subsystems or drivers, which will tell me what else needs to be enabled for ENETC to function correctly. I'm also anticipating platform defines to determine the target processor.

{
  "File": "drivers/net/ethernet/freescale/enetc/Kconfig",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0\n   2:\tconfig FSL_ENETC_CORE\n   3:\t\ttristate\n   4:\t\tselect NXP_NETC_LIB if NXP_NTMP\n   5:\t\thelp\n   6:\t\t  This module supports common functionality between the PF and VF\n   7:\t\t  drivers for the NXP ENETC controller.\n   8:\t\n   9:\t\t  If compiled as module (M), the module name is fsl-enetc-core.\n  10:\t\n  11:\tconfig NXP_ENETC_PF_COMMON\n  12:\t\ttristate\n  13:\t\tselect CRC_ITU_T\n  14:\t\thelp\n  15:\t\t  This module supports common functionality between drivers of\n  16:\t\t  different versions of NXP ENETC PF controllers.\n  17:\t\n  18:\t\t  If compiled as module (M), the module name is nxp-enetc-pf-common.\n  19:\t\n  20:\tconfig NXP_NETC_LIB\n  21:\t\ttristate\n  22:\t\thelp\n  23:\t\t  This module provides common functionalities for both ENETC and NETC\n  24:\t\t  Switch, such as NETC Table Management Protocol (NTMP) 2.0, common tc\n  25:\t\t  flower and debugfs interfaces and so on.\n  26:\t\n  27:\tconfig NXP_NTMP\n  28:\t\tbool\n  29:\t\n  30:\tconfig FSL_ENETC\n  31:\t\ttristate \"ENETC PF driver\"\n  32:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n  33:\t\tdepends on PCI_MSI\n  34:\t\tselect FSL_ENETC_CORE\n  35:\t\tselect FSL_ENETC_IERB\n  36:\t\tselect FSL_ENETC_MDIO\n  37:\t\tselect NXP_ENETC_PF_COMMON\n  38:\t\tselect PHYLINK\n  39:\t\tselect PCS_LYNX\n  40:\t\tselect DIMLIB\n  41:\t\thelp\n  42:\t\t  This driver supports NXP ENETC gigabit ethernet controller PCIe\n  43:\t\t  physical function (PF) devices, managing ENETC Ports at a privileged\n  44:\t\t  level.\n  45:\t\n  46:\t\t  If compiled as module (M), the module name is fsl-enetc.\n  47:\t\n  48:\tconfig NXP_ENETC4\n  49:\t\ttristate \"ENETC4 PF driver\"\n  50:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n  51:\t\tdepends on PCI_MSI\n  52:\t\tselect FSL_ENETC_CORE\n  53:\t\tselect FSL_ENETC_MDIO\n  54:\t\tselect NXP_ENETC_PF_COMMON\n  55:\t\tselect NXP_NTMP\n  56:\t\tselect PHYLINK\n  57:\t\tselect DIMLIB\n  58:\t\thelp\n  59:\t\t  This driver supports NXP ENETC devices with major revision 4. ENETC is\n  60:\t\t  as the NIC functionality in NETC, it supports virtualization/isolation\n  61:\t\t  based on PCIe Single Root IO Virtualization (SR-IOV) and a full range\n  62:\t\t  of TSN standards and NIC offload capabilities.\n  63:\t\n  64:\t\t  If compiled as module (M), the module name is nxp-enetc4.\n  65:\t\n  66:\tconfig FSL_ENETC_VF\n  67:\t\ttristate \"ENETC VF driver\"\n  68:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n  69:\t\tdepends on PCI_MSI\n  70:\t\tselect FSL_ENETC_CORE\n  71:\t\tselect FSL_ENETC_MDIO\n  72:\t\tselect PHYLINK\n  73:\t\tselect DIMLIB\n  74:\t\tselect CRC_ITU_T\n  75:\t\thelp\n  76:\t\t  This driver supports NXP ENETC gigabit ethernet controller PCIe\n  77:\t\t  virtual function (VF) devices enabled by the ENETC PF driver.\n  78:\t\n  79:\t\t  If compiled as module (M), the module name is fsl-enetc-vf.\n  80:\t\n"
}

gemini-3.8-flash

null

null

							input: 11655
							output: 40
							thoughts: 72
						

Here's my understanding of the situation:

**Investigating the FSL_ENETC Driver**

Okay, so I'm looking at the `FSL_ENETC` driver. I see that it's designed to handle NXP's ENETC gigabit ethernet controller, specifically the PCIe Physical Function (PF) devices. Basically, it’s responsible for managing these ENETC ports at a privileged level. Fine, that’s the scope.

Now, where's the actual code? Aha, `FSL_ENETC_CORE` points me to `drivers/net/ethernet/freescale/enetc/enetc.c`. Good, that's the core implementation. Now, the next logical step to get a good handle on how this all works is to take a look at the `Makefile` to see how everything is built, linked, and potentially what other dependencies might be in play. That should give me a better understanding of the overall build process for this module.

{
  "File": "drivers/net/ethernet/freescale/enetc/Makefile",
  "FirstLine": 1,
  "LineCount": 30
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0\n   2:\t\n   3:\tobj-$(CONFIG_FSL_ENETC_CORE) += fsl-enetc-core.o\n   4:\tfsl-enetc-core-y := enetc.o enetc_cbdr.o enetc_ethtool.o\n   5:\t\n   6:\tobj-$(CONFIG_NXP_ENETC_PF_COMMON) += nxp-enetc-pf-common.o\n   7:\tnxp-enetc-pf-common-y := enetc_pf_common.o\n   8:\tnxp-enetc-pf-common-$(CONFIG_PCI_IOV) += enetc_msg.o\n   9:\t\n  10:\tobj-$(CONFIG_NXP_NETC_LIB) += nxp-netc-lib.o\n  11:\tnxp-netc-lib-y := ntmp.o\n  12:\t\n  13:\tobj-$(CONFIG_FSL_ENETC) += fsl-enetc.o\n  14:\tfsl-enetc-y := enetc_pf.o\n  15:\tfsl-enetc-$(CONFIG_FSL_ENETC_QOS) += enetc_qos.o\n  16:\t\n  17:\tobj-$(CONFIG_NXP_ENETC4) += nxp-enetc4.o\n  18:\tnxp-enetc4-y := enetc4_pf.o\n  19:\tnxp-enetc4-$(CONFIG_DEBUG_FS) += enetc4_debugfs.o\n  20:\t\n  21:\tobj-$(CONFIG_FSL_ENETC_VF) += fsl-enetc-vf.o\n  22:\tfsl-enetc-vf-y := enetc_vf.o\n  23:\t\n  24:\tobj-$(CONFIG_FSL_ENETC_IERB) += fsl-enetc-ierb.o\n  25:\tfsl-enetc-ierb-y := enetc_ierb.o\n  26:\t\n  27:\tobj-$(CONFIG_FSL_ENETC_MDIO) += fsl-enetc-mdio.o\n  28:\tfsl-enetc-mdio-y := enetc_pci_mdio.o enetc_mdio.o\n  29:\t\n  30:\tobj-$(CONFIG_FSL_ENETC_PTP_CLOCK) += fsl-enetc-ptp.o\n"
}

gemini-3.8-flash

null

null

							input: 12613
							output: 44
							thoughts: 99
						

Okay, here's my take on those thoughts, framed from my expert perspective:

**Diving into the Freescale ENETC Driver**

Right, so we're looking at `drivers/net/ethernet/freescale/enetc/enetc.c`. My initial question, as always when I see a new driver, is *what* kind of device are we dealing with? From the description, it's clear: Freescale/NXP ENETC. My experience immediately tells me this is likely a physical PCIe NIC driver. The text confirms my initial hypothesis, explicitly stating that it "supports NXP ENETC gigabit ethernet controller PCIe physical function (PF) devices." The "managing ENETC Ports at a privileged level" further reinforces this. Now, to be absolutely certain, and to quickly get a handle on the specifics, I'll need to confirm the supported PCI device IDs. My go-to approach is to check `enetc_pf.c` and `enetc_vf.c`. That will immediately give me the concrete information I need regarding the hardware this driver is intended to support.

{
  "Expression": "PCI_DEVICE|pci_device_id",
  "PathPrefixes": [
    "drivers/net/ethernet/freescale/enetc/"
  ]
}

{
  "Output": "drivers/net/ethernet/freescale/enetc/enetc4_pf.c=1040=static int enetc4_pf_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:1041:\t\t\t   const struct pci_device_id *ent)\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-1042-{\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c=1094=static void enetc4_pf_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-1103-\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:1104:static const struct pci_device_id enetc4_pf_id_table[] = {\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:1105:\t{ PCI_DEVICE(NXP_ENETC_VENDOR_ID, NXP_ENETC_PF_DEV_ID) },\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:1106:\t{ PCI_DEVICE(NXP_ENETC_VENDOR_ID, NXP_ENETC_PPM_DEV_ID) },\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-1107-\t{ 0, } /* End of table. */\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c=36=static int enetc_pci_mdio_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c:37:\t\t\t\tconst struct pci_device_id *ent)\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c-38-{\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c=112=static void enetc_pci_mdio_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c-126-\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c:127:static const struct pci_device_id enetc_pci_mdio_id_table[] = {\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c:128:\t{ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, ENETC_MDIO_DEV_ID) },\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c:129:\t{ PCI_DEVICE(NETC_EMDIO_VEN_ID, NETC_EMDIO_DEV_ID) },\ndrivers/net/ethernet/freescale/enetc/enetc_pci_mdio.c-130-\t{ 0, } /* End of table. */\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c=785=static int enetc_pf_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:786:\t\t\t  const struct pci_device_id *ent)\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-787-{\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c=938=DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_FREESCALE, ENETC_DEV_ID_PF,\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-940-\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:941:static const struct pci_device_id enetc_pf_id_table[] = {\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:942:\t{ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, ENETC_DEV_ID_PF) },\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-943-\t{ 0, } /* End of table. */\n--\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c=26=static int enetc_ptp_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c:27:\t\t\t   const struct pci_device_id *ent)\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c-28-{\n--\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c=113=static void enetc_ptp_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c-124-\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c:125:static const struct pci_device_id enetc_ptp_id_table[] = {\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c:126:\t{ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, ENETC_DEV_ID_PTP) },\ndrivers/net/ethernet/freescale/enetc/enetc_ptp.c-127-\t{ 0, } /* End of table. */\n--\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c=295=static int enetc_vf_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c:296:\t\t\t  const struct pci_device_id *ent)\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c-297-{\n--\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c=389=static void enetc_vf_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c-409-\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c:410:static const struct pci_device_id enetc_vf_id_table[] = {\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c:411:\t{ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, ENETC_DEV_ID_VF) },\ndrivers/net/ethernet/freescale/enetc/enetc_vf.c-412-\t{ 0, } /* End of table. */\n"
}

gemini-3.8-flash

null

null

							input: 14758
							output: 25
							thoughts: 240
						

**My Analysis of ENETC Emulation Compatibility**

Okay, let's see, the instructions highlight structurally unreachable hardware. I need to figure out if the NXP/Freescale ENETC is emulated in standard QEMU or Google Compute Engine, which is key to proceeding. The text specifically mentions vendor-specific PCIe switches, SmartNICs, GPU drivers – those are potential gotchas.

Ah, right, ENETC, the integrated PCIe network controller on NXP Layerscape LS1028A and the ENETC4 on the S32G/i.MX95 series. This isn't just some standard network device; it's *integrated* into those ARM SoCs.

Wait a second…let me clarify this: is there some virtual bus or emulation implemented for ENETC? Or is it purely physical hardware reliant?

The architecture is explicitly specified as `amd64`. Now, the LS1028A is an ARM64 SoC - Layerscape! This is a major disconnect. Can ENETC even run on x86-64 without the actual physical hardware? My gut tells me "no", but I need to confirm.

I better check for an emulation layer or some kind of dummy driver for the `enetc` to determine if a workaround is possible.

{
  "Expression": "enetc",
  "PathPrefixes": [
    "arch/"
  ]
}

{
  "Output": "\nFull output is too long, showing 200 out of 771 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (42 files in total):\narch/arm64/boot/dts/apm/apm-storm.dtsi:4\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts:3\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts:3\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts:4\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts:2\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts:2\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso:1\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dtso:1\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-85bb.dtso:1\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-899b.dtso:1\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts:4\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:7\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:5\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi:14\narch/arm64/boot/dts/freescale/imx94.dtsi:4\narch/arm64/boot/dts/freescale/imx943-evk.dts:6\narch/arm64/boot/dts/freescale/imx95-15x15-ab2.dts:4\narch/arm64/boot/dts/freescale/imx95-15x15-evk.dts:8\narch/arm64/boot/dts/freescale/imx95-15x15-frdm.dts:8\narch/arm64/boot/dts/freescale/imx95-19x19-evk.dts:4\narch/arm64/boot/dts/freescale/imx95-19x19-frdm-pro.dts:8\narch/arm64/boot/dts/freescale/imx95-19x19-verdin-evk.dts:6\narch/arm64/boot/dts/freescale/imx95-aquila-clover.dts:1\narch/arm64/boot/dts/freescale/imx95-aquila-dev.dts:1\narch/arm64/boot/dts/freescale/imx95-aquila.dtsi:4\narch/arm64/boot/dts/freescale/imx95-libra-rdk-fpsc.dts:3\narch/arm64/boot/dts/freescale/imx95-phycore-fpsc.dtsi:7\narch/arm64/boot/dts/freescale/imx95-toradex-smarc-dev.dts:2\narch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi:10\narch/arm64/boot/dts/freescale/imx95-tqma9596la-mba95xxca.dts:10\narch/arm64/boot/dts/freescale/imx95-tqma9596sa-mb-smarc-2.dts:2\narch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi:8\narch/arm64/boot/dts/freescale/imx95-var-dart-sonata.dts:7\narch/arm64/boot/dts/freescale/imx95-var-dart.dtsi:3\narch/arm64/boot/dts/freescale/imx95-verdin-dahlia.dtsi:1\narch/arm64/boot/dts/freescale/imx95-verdin-dev.dtsi:2\narch/arm64/boot/dts/freescale/imx95-verdin-ivy.dtsi:2\narch/arm64/boot/dts/freescale/imx95-verdin-mallow.dtsi:1\narch/arm64/boot/dts/freescale/imx95-verdin-yavia.dtsi:1\narch/arm64/boot/dts/freescale/imx95-verdin-zinnia.dtsi:2\narch/arm64/boot/dts/freescale/imx95-verdin.dtsi:8\narch/arm64/boot/dts/freescale/imx95.dtsi:3\n\narch/arm64/boot/dts/apm/apm-storm.dtsi=215=\t\t\tethclk: ethclk {\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi-227-\narch/arm64/boot/dts/apm/apm-storm.dtsi:228:\t\t\tmenetclk: menetclk {\narch/arm64/boot/dts/apm/apm-storm.dtsi-229-\t\t\t\tcompatible = \"apm,xgene-device-clock\";\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi-233-\t\t\t\treg-names = \"csr-reg\";\narch/arm64/boot/dts/apm/apm-storm.dtsi:234:\t\t\t\tclock-output-names = \"menetclk\";\narch/arm64/boot/dts/apm/apm-storm.dtsi-235-\t\t\t};\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi=971=\t\tmdio: mdio@17020000 {\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi-975-\t\t\treg = \u003c0x0 0x17020000 0x0 0xd100\u003e;\narch/arm64/boot/dts/apm/apm-storm.dtsi:976:\t\t\tclocks = \u003c\u0026menetclk 0\u003e;\narch/arm64/boot/dts/apm/apm-storm.dtsi-977-\t\t};\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi=979=\t\tmenet: ethernet@17020000 {\n--\narch/arm64/boot/dts/apm/apm-storm.dtsi-987-\t\t\tdma-coherent;\narch/arm64/boot/dts/apm/apm-storm.dtsi:988:\t\t\tclocks = \u003c\u0026menetclk 0\u003e;\narch/arm64/boot/dts/apm/apm-storm.dtsi-989-\t\t\t/* mac address will be overwritten by the bootloader */\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts=30=\t\tpower-led {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-38-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts:39:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-40-\t/* BCM54140 QSGMII quad PHY */\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts=53=\tqsgmii_phy3: ethernet-phy@10 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-57-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts:58:\u0026enetc_port2 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-59-\tnvmem-cells = \u003c\u0026base_mac_address 2\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-63-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts:64:\u0026enetc_port3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dts-65-\tnvmem-cells = \u003c\u0026base_mac_address 3\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts=19=/ {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-23-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts:24:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-25-\t/* Delete unused phy node */\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts=43=\t\tvddh: vddh-regulator {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-48-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts:49:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-50-\tstatus = \"disabled\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-54-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts:55:\u0026enetc_port1 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var1.dts-56-\tphy-handle = \u003c\u0026phy0\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts=15=/ {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-19-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts:20:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-21-\tphy1: ethernet-phy@4 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-27-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts:28:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-29-\tstatus = \"disabled\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-37-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts:38:\u0026enetc_port2 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-39-\tnvmem-cells = \u003c\u0026base_mac_address 2\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-43-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts:44:\u0026enetc_port3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts-45-\tnvmem-cells = \u003c\u0026base_mac_address 3\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts=16=/ {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts-20-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts:21:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts-22-\tphy1: ethernet-phy@4 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts=37=\t\tvddh: vddh-regulator {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts-42-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts:43:\u0026enetc_port1 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var4.dts-44-\tphy-handle = \u003c\u0026phy1\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts=79=\u0026duart1 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts-82-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts:83:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts-84-\tphy0: ethernet-phy@5 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts-90-\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts:91:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts-92-\tphy-handle = \u003c\u0026phy0\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso=19=\tslot1_sgmii: ethernet-phy@2 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso-25-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso:26:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso-27-\tphy-handle = \u003c\u0026slot1_sgmii\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dtso=18=\tslot1_sgmii: ethernet-phy@2 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dtso-24-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dtso:25:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dtso-26-\tphy-handle = \u003c\u0026slot1_sgmii\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-85bb.dtso=18=\tslot1_sgmii: ethernet-phy@1c {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-85bb.dtso-23-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-85bb.dtso:24:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-85bb.dtso-25-\tphy-handle = \u003c\u0026slot1_sgmii\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-899b.dtso=31=\tslot1_sgmii3: ethernet-phy@1f {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-899b.dtso-35-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-899b.dtso:36:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds-899b.dtso-37-\tphy-handle = \u003c\u0026slot1_sgmii0\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts=92=\tmdio-mux {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-94-\t\tmux-controls = \u003c\u0026mux 0\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts:95:\t\tmdio-parent-bus = \u003c\u0026enetc_mdio_pf3\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-96-\t\t#address-cells = \u003c1\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts=234=\u0026duart1 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-237-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts:238:\u0026enetc_port1 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-239-\tphy-handle = \u003c\u0026qds_phy1\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-243-\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts:244:\u0026enetc_port2 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-245-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts=371=\u0026mscc_felix_port4 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts:372:\tethernet = \u003c\u0026enetc_port2\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts-373-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts=18=\taliases {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-25-\t\tspi0 = \u0026fspi;\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:26:\t\tethernet0 = \u0026enetc_port0;\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:27:\t\tethernet1 = \u0026enetc_port2;\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-28-\t\tethernet2 = \u0026mscc_felix_port0;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-33-\t\tethernet7 = \u0026mscc_felix_port5;\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:34:\t\tethernet8 = \u0026enetc_port3;\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-35-\t};\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts=119=\u0026duart1 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-122-\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:123:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-124-\tsgmii_phy0: ethernet-phy@2 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts=141=\tqsgmii_phy3: ethernet-phy@13 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-145-\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:146:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-147-\tphy-handle = \u003c\u0026sgmii_phy0\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-152-\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:153:\u0026enetc_port2 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-154-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-156-\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts:157:\u0026enetc_port3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-rdb.dts-158-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi=141=\t\tqsgmii-rstn-hog {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-149-\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:150:\u0026enetc_mdio_pf3 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-151-\tmdio0_rgmii_phy00: ethernet-phy@0 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi=193=\tqsgmii_phy4: ethernet-phy@1f {\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-197-\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:198:\u0026enetc_port0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-199-\tphy-handle = \u003c\u0026mdio0_sgmii_phy03\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-204-\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:205:\u0026enetc_port1 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-206-\tphy-handle = \u003c\u0026mdio0_rgmii_phy00\u003e;\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-210-\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:211:\u0026enetc_port2 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-212-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi=244=\u0026mscc_felix_port4 {\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi:245:\tethernet = \u003c\u0026enetc_port2\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1028a-tqmls1028a-mbls1028a.dtsi-246-\tstatus = \"okay\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi=1103=\t\tpcie@1f0000000 { /* Integrated Endpoint Root Complex */\n--\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi-1132-\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi:1133:\t\t\tenetc_port0: ethernet@0,0 {\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi:1134:\t\t\t\tcompatible = \"pci1957,e100\", \"fsl,enetc\";\narch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi-1135-\t\t\t\treg = \u003c0x000000 0 0 0 0\u003e;\n--\n\n"
}

gemini-3.8-flash

null

null

							input: 23253
							output: 137
							thoughts: 1268
						

**Analysis of the ENETC Driver Modification for Fuzzing Suitability**

Okay, so I'm looking at this patch and immediately, the `pcie@1f0000000` and `enetc_port0: ethernet@0,0` lines jump out. This is the NXP ENETC, an integrated endpoint on their LS1028A and i.MX95 SoCs. And already, my initial assessment is confirmed: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers... requiring physical ASIC/PCIe cards not emulated in standard QEMU" is the keyword here. This clearly falls under "Structurally unreachable hardware."

The code's purpose revolves around TX frame padding, TSO buffers, and XDP transmit synchronization, all functionalities within the ENETC driver. Functions like `enetc_alloc_tx_resource`, `enetc_start_xmit`, `enetc_clean_rx_ring_xdp`, and the XDP-related functions are all internal driver operations. They are called by PCI drivers that are registered via `pci_register_driver`.

Now, the target architecture is amd64. That's the key. QEMU, in its standard configuration, *does not* emulate the Freescale/NXP ENETC. This is a hardware controller embedded within their ARM64 SoCs. Without that physical ENETC hardware, these driver functions will *never* be called. No `net_device` will be registered, the code paths are unreachable, and it doesn't matter what the driver is trying to do here.

Let's quickly check the changed files to be sure. Only `enetc.c` and `enetc.h` under `drivers/net/ethernet/freescale/enetc/`? Yep, that's what I thought. These are ENETC specific and don't involve platform-agnostic device registration or anything else that might be emulated.

Now, let's verify Section 2 of the instructions: "WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)."  It specifies "Structurally unreachable hardware" as a direct reason. And we have that precisely.

There are no software devices, mocks or other non-hardware implementations here. `FSL_ENETC` is a hardware controller driver. The target is amd64, and the ENETC is an ARM64-specific on-chip peripheral. Therefore, this code is undeniably structurally unreachable in a standard virtualized environment like QEMU or GCE on amd64.

Okay, let's set:
-   `WorthFuzzing`: false
-   `FocusSymbols`: []
-   `EnableConfigs`: []

And for the `Reasoning`: The patch modifies the Freescale/NXP ENETC driver (`drivers/net/ethernet/freescale/enetc/`), specifically handling TX frame padding, TSO buffers, and XDP transmit synchronization. ENETC is an integrated PCIe network controller specific to NXP/Freescale SoCs (such as NXP LS1028A / i.MX95) and requires physical hardware that is not emulated in standard QEMU or GCE virtualized environments, making it structurally unreachable on amd64. Therefore, it is not worth fuzzing.

Everything checks out. Time to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the NXP/Freescale ENETC ethernet controller driver (drivers/net/ethernet/freescale/enetc/), adjusting TX frame padding, TSO handling, and XDP locking. ENETC is an integrated controller found on NXP SoCs (e.g., LS1028A, i.MX95) and requires physical hardware not emulated in standard QEMU/GCE virtualized test environments on amd64. Therefore, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the NXP/Freescale ENETC ethernet controller driver (drivers/net/ethernet/freescale/enetc/), adjusting TX frame padding, TSO handling, and XDP locking. ENETC is an integrated controller found on NXP SoCs (e.g., LS1028A, i.MX95) and requires physical hardware not emulated in standard QEMU/GCE virtualized test environments on amd64. Therefore, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null